registry / @kerebron/legacy-compat / 0.8.11
@kerebron/legacy-compat@0.8.11
⚠ Under reviewPackages from NPM can be directly accessed using https://cdn.jsdelivr.net.
Static Scan Results
scanned 22d ago · by rust-scannerStatic analysis completed at 86.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flagged · loading sourcedist/kerebron.cjsView file
229contains invisible/control Unicode U+200B (zero width space)
<U+200B>`);let e=this.save();e&&(e.start=--e.end,this.restore(e))}else insert$1(`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/kerebron.cjsView on unpkg · L229•Trigger-reachable chain: manifest.main -> dist/kerebron.cjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/kerebron.cjsView on unpkg203${t}`)}let r=e.clone();try{n=await WebAssembly.compileStreaming(e)}catch(e){console.error(`wasm streaming compile failed:`,e),console.error(`falling back to ArrayBuffer instantiati...
L204: ${JSON.stringify(a,null,2)}`),Error(`Language.load failed: no language function found in Wasm file`);return new e(INTERNAL,r[o]())}};async function Module2(moduleArg={}){var module...
L205: `)[0],s=o.match(QUERY_WORD_REGEX)?.[0]??``;switch(C._free(r),e){case QueryErrorKind$1.Syntax:throw new QueryError$1(QueryErrorKind$1.Syntax,{suffix:`${a}: '${o}'...`},a,0);case Que...
Low
Findings
2 Critical1 High2 Medium4 Low
CriticalTrojan Source Unicodedist/kerebron.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/kerebron.cjs
HighSemantic Analysis Limiteddist/kerebron-light.css
MediumNetwork
MediumStructural Risk Force Deep Review
LowEvaldist/kerebron.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @kerebron/legacy-compat@0.8.11.
See all versions of @kerebron/legacy-compat for other recorded verdicts.
- Review the evidence and your use of @kerebron/legacy-compat@0.8.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.