@jacebenson/jsn@4.3.7

⚠ Under review

A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 83 file(s), 858 KB of source, external domains: 127.0.0.1, dev12345.service-now.com, dev328604.service-now.com, github.com, raw.githubusercontent.com, registry.npmjs.org, store.servicenow.com, www.w3.org

Source & flagged code

5 flagged

src/auth.jsView file

9import crypto from 'node:crypto'; L10: import { execFileSync } from 'node:child_process'; L11: import { password as passwordPrompt } from '@inquirer/prompts';

High

Child Process

Package source references child process execution.

src/auth.jsView on unpkg · L9

src/commands/skill.jsView file

19L20: const SKILL_RAW_URL = 'https://raw.githubusercontent.[redacted].md'; L21: ... L29: try { L30: const result = execSync('getent passwd ' + process.env.USER + ' 2>/dev/null', { encoding: 'utf-8', timeout: 3000 }); L31: const home = result.trim().split(':')[5];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/commands/skill.jsView on unpkg · L19

6L7: import { execSync } from 'node:child_process'; L8: ... L19: L20: const SKILL_RAW_URL = 'https://raw.githubusercontent.[redacted].md'; L21: ... L24: */ L25: function realHomeDir() { L26: // getent doesn't exist on Windows; os.homedir() is reliable there. L27: if (process.platform === 'win32') return os.homedir(); L28: L29: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/skill.jsView on unpkg · L6

src/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/cli.js#virtual:normalized:round1View on unpkg

src/commands/docs/public/vendor/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = @mindexec/cli@0.2.478 matchedPath = wwwroot/_content/MindExecution.Shared/js/marked.min.js matchedIdentity = npm:QG1pbmRleGVjL2NsaQ:0.2.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/docs/public/vendor/marked.min.jsView on unpkg

Source & flagged code

5 flagged · loading source

src/auth.jsView file

9import crypto from 'node:crypto'; L10: import { execFileSync } from 'node:child_process'; L11: import { password as passwordPrompt } from '@inquirer/prompts';

High

Child Process

Package source references child process execution.

src/auth.jsView on unpkg · L9

src/commands/skill.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/commands/skill.jsView on unpkg · L19

Findings

6 High3 Medium5 Low

HighChild Processsrc/auth.js

HighShell

HighSame File Env Network Executionsrc/commands/skill.js

HighSandbox Evasion Gated Capabilitysrc/commands/skill.js

HighSemantic Analysis Limitedsrc/cli.js#virtual:normalized:round1

HighKnown Malware Source Similaritysrc/commands/docs/public/vendor/marked.min.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @jacebenson/jsn@4.3.7.

See all versions of @jacebenson/jsn for other recorded verdicts.

Review the evidence and your use of @jacebenson/jsn@4.3.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 03:40:05.336Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.