registry / @jcbhmr/go-linux-riscv64 / 1.26.6

@jcbhmr/go-linux-riscv64@1.26.6

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 6 file(s), 180 KB of source, external domains: goo.gl, www.w3.org

Source & flagged code

12 flagged

src/crypto/x509/platform_root_key.pemView file

Lines 1-6text

1-----BEGIN EC PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/crypto/x509/platform_root_key.pemView on unpkg · L1

Critical

Secret Pattern

EC private key in src/crypto/x509/platform_root_key.pem

src/crypto/x509/platform_root_key.pemView on unpkg · L1

2MHcCAQEEIHhv8LVzb9gqJzAY0P442+FW0oqbfBrLnfqxyyAujOFSoAoGCCqGSM49

3AwEHoUQDQgAE5dNQY4FY29i2g3xx7FyH4XiZz0C0AM4uyPUsXCZNb7CsctHDLhLt

4zABWSfFz76j+oVhq+qKrwIHsLX+7f6YTQg==

5-----END EC PRIVATE KEY-----

src/internal/trace/traceviewer/static/webcomponents.min.jsView file

Lines 1-14javascript

1/**

2 * @license

4 * This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt

5 * The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt

6 * The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt

7 * Code distributed by Google as part of the polymer project is also

8 * subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt

9 */

10// @version 0.7.24

bin/goView file

•path = bin/go kind = native_binary sizeBytes = 13822548 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/goView on unpkg

lib/time/update.bashView file

•path = lib/time/update.bash kind = build_helper sizeBytes = 2201 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/time/update.bashView on unpkg

lib/time/zoneinfo.zipView file

•path = lib/time/zoneinfo.zip kind = compressed_blob sizeBytes = 408125 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/time/zoneinfo.zipView on unpkg

•path = lib/time/zoneinfo.zip kind = nested_archive_needs_inspection sizeBytes = 408125 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/time/zoneinfo.zipView on unpkg

lib/fips140/v1.0.0-c2097c7c.zipView file

•path = lib/fips140/v1.0.0-c2097c7c.zip kind = high_entropy_blob sizeBytes = 658130 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/fips140/v1.0.0-c2097c7c.zipView on unpkg

src/cmd/compile/internal/test/testdata/pgo/inline/inline_hot.pprofView file

•path = [redacted]inline_hot.pprof kind = payload_in_excluded_dir sizeBytes = 943 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/cmd/compile/internal/test/testdata/pgo/inline/inline_hot.pprofView on unpkg

src/crypto/tls/testdata/example-key.pemView file

Lines 1-6text

1-----BEGIN EC PRIVATE KEY-----

Critical

Secret Pattern

EC private key in src/crypto/tls/testdata/example-key.pem

src/crypto/tls/testdata/example-key.pemView on unpkg · L1

2MHcCAQEEIIrYSSNQFaA2Hwf1duRSxKtLYX5CB04fSeQ6tF1aY/PuoAoGCCqGSM49

3AwEHoUQDQgAEPR3tU2Fta9ktY+6P9G0cWO+0kETA6SFs38GecTyudlHz6xvCdz8q

4EKTcWGekdmdDPsHloRNtsiCa697B2O9IFA==

5-----END EC PRIVATE KEY-----

src/crypto/tls/example_test.goView file

Lines 116-185text

116 cfg := &tls.Config{Certificates: []tls.Certificate{cert}}

117 listener, err := tls.Listen("tcp", ":2000", cfg)

118 if err != nil {

119 log.Fatal(err)

120 }

121 _ = listener

122}

123

124func ExampleX509KeyPair() {

125 certPem := []byte(`-----BEGIN CERTIFICATE-----

126MIIBhTCCASugAwIBAgIQIRi6zePL6mKjOipn+dNuaTAKBggqhkjOPQQDAjASMRAw

127DgYDVQQKEwdBY21lIENvMB4XDTE3MTAyMDE5NDMwNloXDTE4MTAyMDE5NDMwNlow

Source & flagged code

12 flagged · loading source

src/crypto/x509/platform_root_key.pemView file

1patternName = private_key_ec severity = critical line = 1 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/crypto/x509/platform_root_key.pemView on unpkg · L1

1patternName = private_key_ec severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

EC private key in src/crypto/x509/platform_root_key.pem

src/crypto/x509/platform_root_key.pemView on unpkg · L1

src/internal/trace/traceviewer/static/webcomponents.min.jsView file

10// @version 0.7.24 L11: !function(){window.WebComponents=window.WebComponents||{flags:{}};var e="webcomponents.js",t=document.querySelector('script[src*="'+e+'"]'),n={};if(!n.noOpts){if(location.search.sl... L12: querySelector:function(t){var r=n(t),i=r!==t;t=r;var a,s=g(this),c=v(this).root;if(c instanceof e.wrappers.ShadowRoot)return o(this,t);if(s instanceof N)a=b(E.call(s,t));else{if(!(...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/internal/trace/traceviewer/static/webcomponents.min.jsView on unpkg · L10

bin/goView file

•path = bin/go kind = native_binary sizeBytes = 13822548 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/goView on unpkg

lib/time/update.bashView file

•path = lib/time/update.bash kind = build_helper sizeBytes = 2201 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/time/update.bashView on unpkg

lib/time/zoneinfo.zipView file

•path = lib/time/zoneinfo.zip kind = compressed_blob sizeBytes = 408125 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/time/zoneinfo.zipView on unpkg

•path = lib/time/zoneinfo.zip kind = nested_archive_needs_inspection sizeBytes = 408125 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/time/zoneinfo.zipView on unpkg

lib/fips140/v1.0.0-c2097c7c.zipView file

•path = lib/fips140/v1.0.0-c2097c7c.zip kind = high_entropy_blob sizeBytes = 658130 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/fips140/v1.0.0-c2097c7c.zipView on unpkg

src/cmd/compile/internal/test/testdata/pgo/inline/inline_hot.pprofView file

•path = [redacted]inline_hot.pprof kind = payload_in_excluded_dir sizeBytes = 943 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/cmd/compile/internal/test/testdata/pgo/inline/inline_hot.pprofView on unpkg

src/crypto/tls/testdata/example-key.pemView file

1patternName = private_key_ec severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

EC private key in src/crypto/tls/testdata/example-key.pem

src/crypto/tls/testdata/example-key.pemView on unpkg · L1

src/crypto/tls/example_test.goView file

136patternName = private_key_ec severity = critical line = 136 matchedText = keyPem :...----

Critical

Secret Pattern

EC private key in src/crypto/tls/example_test.go

src/crypto/tls/example_test.goView on unpkg · L136

165patternName = private_key_ec severity = critical line = 165 matchedText = keyPem :...----

Critical

Secret Pattern

EC private key in src/crypto/tls/example_test.go

src/crypto/tls/example_test.goView on unpkg · L165

Findings

5 Critical2 High6 Medium7 Low

CriticalCritical Secretsrc/crypto/x509/platform_root_key.pem

CriticalSecret Patternsrc/crypto/x509/platform_root_key.pem

CriticalSecret Patternsrc/crypto/tls/testdata/example-key.pem

CriticalSecret Patternsrc/crypto/tls/example_test.go

HighShips High Entropy Bloblib/fips140/v1.0.0-c2097c7c.zip

HighPayload In Excluded Dirsrc/cmd/compile/internal/test/testdata/pgo/inline/inline_hot.pprof

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/go

MediumShips Build Helperlib/time/update.bash

MediumShips Compressed Bloblib/time/zoneinfo.zip

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/internal/trace/traceviewer/static/webcomponents.min.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionlib/time/zoneinfo.zip

LowNo License

Source & flagged code

12 flagged

src/crypto/x509/platform_root_key.pemView file

Lines 1-6text

1-----BEGIN EC PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/crypto/x509/platform_root_key.pemView on unpkg · L1

Critical

Secret Pattern

EC private key in src/crypto/x509/platform_root_key.pem

src/crypto/x509/platform_root_key.pemView on unpkg · L1

2MHcCAQEEIHhv8LVzb9gqJzAY0P442+FW0oqbfBrLnfqxyyAujOFSoAoGCCqGSM49

3AwEHoUQDQgAE5dNQY4FY29i2g3xx7FyH4XiZz0C0AM4uyPUsXCZNb7CsctHDLhLt

4zABWSfFz76j+oVhq+qKrwIHsLX+7f6YTQg==

5-----END EC PRIVATE KEY-----

src/internal/trace/traceviewer/static/webcomponents.min.jsView file

Lines 1-14javascript

1/**

2 * @license

4 * This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt

5 * The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt

6 * The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt

7 * Code distributed by Google as part of the polymer project is also

8 * subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt

9 */

10// @version 0.7.24

bin/goView file

•path = bin/go kind = native_binary sizeBytes = 13822548 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/goView on unpkg

lib/time/update.bashView file

•path = lib/time/update.bash kind = build_helper sizeBytes = 2201 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/time/update.bashView on unpkg

lib/time/zoneinfo.zipView file

•path = lib/time/zoneinfo.zip kind = compressed_blob sizeBytes = 408125 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/time/zoneinfo.zipView on unpkg

•path = lib/time/zoneinfo.zip kind = nested_archive_needs_inspection sizeBytes = 408125 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/time/zoneinfo.zipView on unpkg

lib/fips140/v1.0.0-c2097c7c.zipView file

•path = lib/fips140/v1.0.0-c2097c7c.zip kind = high_entropy_blob sizeBytes = 658130 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/fips140/v1.0.0-c2097c7c.zipView on unpkg

src/cmd/compile/internal/test/testdata/pgo/inline/inline_hot.pprofView file

•path = [redacted]inline_hot.pprof kind = payload_in_excluded_dir sizeBytes = 943 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/cmd/compile/internal/test/testdata/pgo/inline/inline_hot.pprofView on unpkg

src/crypto/tls/testdata/example-key.pemView file

Lines 1-6text

1-----BEGIN EC PRIVATE KEY-----

Critical

Secret Pattern

EC private key in src/crypto/tls/testdata/example-key.pem

src/crypto/tls/testdata/example-key.pemView on unpkg · L1

2MHcCAQEEIIrYSSNQFaA2Hwf1duRSxKtLYX5CB04fSeQ6tF1aY/PuoAoGCCqGSM49

3AwEHoUQDQgAEPR3tU2Fta9ktY+6P9G0cWO+0kETA6SFs38GecTyudlHz6xvCdz8q

4EKTcWGekdmdDPsHloRNtsiCa697B2O9IFA==

5-----END EC PRIVATE KEY-----

src/crypto/tls/example_test.goView file

Lines 116-185text

116 cfg := &tls.Config{Certificates: []tls.Certificate{cert}}

117 listener, err := tls.Listen("tcp", ":2000", cfg)

118 if err != nil {

119 log.Fatal(err)

120 }

121 _ = listener

122}

123

124func ExampleX509KeyPair() {

125 certPem := []byte(`-----BEGIN CERTIFICATE-----

126MIIBhTCCASugAwIBAgIQIRi6zePL6mKjOipn+dNuaTAKBggqhkjOPQQDAjASMRAw

127DgYDVQQKEwdBY21lIENvMB4XDTE3MTAyMDE5NDMwNloXDTE4MTAyMDE5NDMwNlow