registry / @kilianpaquier/semantic-release-backmerge / 1.8.0

@kilianpaquier/semantic-release-backmerge@1.8.0

<div align="center"> <img alt="GitLab Release" src="https://img.shields.io/gitlab/v/release/kilianpaquier%2Fsemantic-release-backmerge?gitlab_url=https%3A%2F%2Fgitlab.com&include_prereleases&sort=semver&style=for-the-badge"> <img alt="GitLab Issues" s

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 265 KB of source, external domains: api.github.com, github.com, npms.io

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-21javascript

1import{createRequire as AR}from"node:module";var MR=Object.create;var{getPrototypeOf:CR,defineProperty:HX,getOwnPropertyNames:TR}=Object;var ER=Object.prototype.hasOwnProperty;function OR($){return this[$]}var wR,NR,w1=($,Q,J)=>{var Y=$!=null&&typeof $==="object";if(Y){var q=Q?wR??=new WeakMap:NR??=new WeakMap,H=q.get($);if(H)return H}J=$!=null?MR(CR($)):{};let U=Q||!$||!$.__esModule?HX(J,"default",{value:$,enumerable:!0}):J;for(let W of TR($))if(!ER.call(U,W))HX(U,W,{get:OR.bind($,W),enumerable:!0});if(Y)q.set($,U);return U};var k=($,Q)=>()=>(Q||$((Q={exports:{}}).exports,Q),Q.exports);var J1 ...

2`).join(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

3`+H),$.push(q+"m+"+CQ.exports.humanize(this.diff)+"\x1B[0m")}else $[0]=NN()+Q+" "+$[0]}function NN(){if(AH.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function AN(...$){return process.stderr.write(MQ.formatWithOptions(AH.inspectOpts,...$)+`

4`)}function IN($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function xN(){return process.env.DEBUG}function kN($){$.inspectOpts={};let Q=Object.keys(AH.inspectOpts);for(let J=0;J<Q.length;J++)$.inspectOpts[Q[J]]=AH.inspectOpts[Q[J]]}CQ.exports=b7()(AH);var{formatters:NH}=CQ.exports;NH.o=function($){return this.inspectOpts.colors=this.useColors,MQ.inspect($,this.inspectOpts).split(`

5`).map((Q)=>Q.trim()).join(" ")};NH.O=function($){return this.inspectOpts.colors=this.useColors,MQ.inspect($,this.inspectOpts)}});var Y4=k((Fc,d7)=>{if(typeof process>"u"||process.type==="renderer"||!1||process.__nwjs)d7.exports=MH();else d7.exports=xH()});var l7=k((xc,mH)=>{mH.exports=function(Q,J){if(J===!0)J=0;var Y="";if(typeof Q==="string")try{Y=new URL(Q).protocol}catch(H){}else if(Q&&Q.constructor===URL)Y=Q.protocol;var q=Y.split(/\:|\+/).filter(Boolean);if(typeof J==="number")return q[J];return q}});var pH=k((kc,dH)=>{var pN=l7();function cN($){var Q={protocols:[],protocol:null,port:nu ...

6 * buildToken

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

7 * Builds OAuth token prefix (helper function)

8 *

9 * @name buildToken

10 * @function

11 * @param {GitUrl} obj The parsed Git url object.

12 * @return {String} token prefix

13 */function UA($){switch($.source){case"bitbucket.org":return"x-token-auth:"+$.token+"@";default:return $.token+"@"}}function BA($){switch($.source){case"bitbucket-server":return"scm/"+$.full_name;default:var Q=$.full_name.split("/").map(function(J){return encodeURIComponent(J)}).join("/");return Q}}function WA($,Q){var J="";return Q.forEach(function(Y){if($.includes(Y)&&Y.length>J.length)J=Y}),J}QG.exports=i7});var z$=k((yc,ZG)=>{var _A=Number.MAX_SAFE_INTEGER||9007199254740991,zA=["major","premajor","minor","preminor","patch","prepatch","prerelease"];ZG.exports={MAX_LENGTH:256,MAX_SAFE_COMPO ...

14/* [wrapped with `+X+`] */

15`)}function $V(Z){return u(Z)||T6(Z)||!!(CJ&&Z&&Z[CJ])}function b1(Z,X){var K=typeof Z;return X=X==null?

16`;Z.replace(x,function(b,t,e,l0,j0,i0){if(e||(e=l0),I+=Z.slice(N,i0).replace(zW,J_),t)R=!0,I+=`' +

17__e(`+t+`) +

18'`;if(j0)C=!0,I+=`';

19`+j0+`;

20__p += '`;if(e)I+=`' +

21((__t = (`+e+`)) == null ? '' : __t) +

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/index.jsView file

1import{createRequire as AR}from"node:module";var MR=Object.create;var{getPrototypeOf:CR,defineProperty:HX,getOwnPropertyNames:TR}=Object;var ER=Object.prototype.hasOwnProperty;func... L2: `).join(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1import{createRequire as AR}from"node:module";var MR=Object.create;var{getPrototypeOf:CR,defineProperty:HX,getOwnPropertyNames:TR}=Object;var ER=Object.prototype.hasOwnProperty;func... L2: `).join(` ... L4: `)}function IN($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function xN(){return process.env.DEBUG}function kN($){$.inspectOpts={};let Q=Object.keys(AH.inspectOpts);fo... L5: `).map((Q)=>Q.trim()).join(" ")};NH.O=function($){return this.inspectOpts.colors=this.useColors,MQ.inspect($,this.inspectOpts)}});var Y4=k((Fc,d7)=>{if(typeof process>"u"||process.... L6: * buildToken

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1import{createRequire as AR}from"node:module";var MR=Object.create;var{getPrototypeOf:CR,defineProperty:HX,getOwnPropertyNames:TR}=Object;var ER=Object.prototype.hasOwnProperty;func... L2: `).join(` L3: `+H),$.push(q+"m+"+CQ.exports.humanize(this.diff)+"\x1B[0m")}else $[0]=NN()+Q+" "+$[0]}function NN(){if(AH.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}functio... L4: `)}function IN($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function xN(){return process.env.DEBUG}function kN($){$.inspectOpts={};let Q=Object.keys(AH.inspectOpts);fo... L5: `).map((Q)=>Q.trim()).join(" ")};NH.O=function($){return this.inspectOpts.colors=this.useColors,MQ.inspect($,this.inspectOpts)}});var Y4=k((Fc,d7)=>{if(typeof process>"u"||process.... L6: * buildToken

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Findings

3 High1 Medium4 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-21javascript

2`).join(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

6 * buildToken

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

7 * Builds OAuth token prefix (helper function)

8 *

9 * @name buildToken

10 * @function

11 * @param {GitUrl} obj The parsed Git url object.

12 * @return {String} token prefix

14/* [wrapped with `+X+`] */

15`)}function $V(Z){return u(Z)||T6(Z)||!!(CJ&&Z&&Z[CJ])}function b1(Z,X){var K=typeof Z;return X=X==null?

16`;Z.replace(x,function(b,t,e,l0,j0,i0){if(e||(e=l0),I+=Z.slice(N,i0).replace(zW,J_),t)R=!0,I+=`' +

17__e(`+t+`) +

18'`;if(j0)C=!0,I+=`';

19`+j0+`;

20__p += '`;if(e)I+=`' +

21((__t = (`+e+`)) == null ? '' : __t) +

Long lines were clipped for display.