Static Scan Results
scanned 8d ago · by rust-scannerStatic analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsObfuscatedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/start-BopA4OXE.mjsView file
22428}
L22429: exec(t) {
L22430: let e = this.acquireMatcher(t), s = this._global ? this._lastIndex : 0;
High
Child Process
Package source references child process execution.
dist/start-BopA4OXE.mjsView on unpkg · L22428dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file
17strategy: "throw",
L18: reason: "eval() allows arbitrary code execution"
L19: },
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/chunk-TN7HHBQW-D_SK6w5n.cjsView on unpkg · L17dist/head-442HYESI-Dl61xdxd.cjsView file
1require("./start-B-r5AcHg.cjs");
L2: require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/head-442HYESI-Dl61xdxd.cjsView on unpkg · L1dist/dist-Dfoa0fsU.mjsView file
7import { AsyncLocalStorage } from "node:async_hooks";
L8: import { deleteSecretValuesForRef, ensureOAuthApp, getOrganizationScopeId, saveOAuthConnection, selectSecretValue, upsertSecretValue } from "@keystrokehq/platform-database";
L9: import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
L10: import * as z$1 from "zod/v4";
...
L17: import { join } from "node:path";
L18: import { spawnSync } from "node:child_process";
L19: import { tmpdir } from "node:os";
...
L593: * (timestamps embedded in the id). Use {@link cuid2} instead.
L594: * See https://github.com/paralleldrive/cuid.
L595: */
...
L4825: "previews",
L4826: "private",
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/dist-Dfoa0fsU.mjsView on unpkg · L7dist/dist-BSIIH4ft.cjsView file
31let node_async_hooks = require("node:async_hooks");
L32: let _keystrokehq_platform_database = require("@keystrokehq/platform-database");
L33: let node_crypto = require("node:crypto");
...
L45: let node_path = require("node:path");
L46: let node_child_process = require("node:child_process");
L47: let node_os = require("node:os");
...
L597: * (timestamps embedded in the id). Use {@link cuid2} instead.
L598: * See https://github.com/paralleldrive/cuid.
L599: */
...
L626: const cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
L627: const base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
L628: const base64url = /^[A-Za-z0-9_-]*$/;
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/dist-BSIIH4ft.cjsView on unpkg · L3131let node_async_hooks = require("node:async_hooks");
L32: let _keystrokehq_platform_database = require("@keystrokehq/platform-database");
L33: let node_crypto = require("node:crypto");
...
L45: let node_path = require("node:path");
L46: let node_child_process = require("node:child_process");
L47: let node_os = require("node:os");
...
L597: * (timestamps embedded in the id). Use {@link cuid2} instead.
L598: * See https://github.com/paralleldrive/cuid.
L599: */
...
L626: const cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
L627: const base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
L628: const base64url = /^[A-Za-z0-9_-]*$/;
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/dist-BSIIH4ft.cjsView on unpkg · L31dist/js-exec-N5KEZBH7-BfVFKq8I.cjsView file
40Cross-file remote execution chain: dist/js-exec-N5KEZBH7-BfVFKq8I.cjs spawns dist/chunk-TN7HHBQW-D_SK6w5n.cjs; helper contains network access plus dynamic code execution.
L40: Available modules:
L41: fs, path, child_process, process, console,
L42: os, url, assert, util, events, buffer, stream,
...
L55: child_process:
L56: execSync(cmd) throws on non-zero exit, returns stdout
L57: spawnSync(cmd, args) returns { stdout, stderr, status }
...
L61:
L62: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(),
L63: EOL, cpus(), endianness()
L64:
L65: url: URL, URLSearchParams, parse(), format()
L66:
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/js-exec-N5KEZBH7-BfVFKq8I.cjsView on unpkg · L40Findings
4 High5 Medium9 Low
HighChild Processdist/start-BopA4OXE.mjs
HighShell
HighCloud Metadata Accessdist/dist-BSIIH4ft.cjs
HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-BfVFKq8I.cjs
MediumDynamic Requiredist/head-442HYESI-Dl61xdxd.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/dist-BSIIH4ft.cjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/chunk-TN7HHBQW-D_SK6w5n.cjs
LowWeak Cryptodist/dist-Dfoa0fsU.mjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License