Static Scan Results
scanned 3h ago · by rust-scannerStatic analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Oversized source lightweight scan
dist/master/dashboard/assets/monaco-core-oQiQUisy.js2.43 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringscode.visualstudio.comgithub.com
dist/master/dashboard/assets/ts.worker-BhkL8olL.js5.74 MB file, sampled 256 KB
FilesystemNetworkUrlStringswww.apache.org
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-node-pty-perms.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/cli/join.jsView file
37try {
L38: const { execSync } = require("node:child_process");
L39: const p = execSync(`command -v ${tool}`, { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli/join.jsView on unpkg · L37dist/master/repo-scan.jsView file
17import { createHash } from "node:crypto";
L18: import { spawnSync } from "node:child_process";
L19: import fs from "node:fs";
...
L21: import path from "node:path";
L22: const REPOS_ROOT = path.join(os.homedir(), ".rotom", "repos");
L23: export function repoIdFor(url) {
...
L62: ok: r.status === 0,
L63: stdout: typeof r.stdout === "string" ? r.stdout : "",
L64: stderr: typeof r.stderr === "string" ? r.stderr : "",
...
L166: try {
L167: const parsed = JSON.parse(group.extra_repos);
L168: if (Array.isArray(parsed)) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/master/repo-scan.jsView on unpkg · L17bin/rotom-up.shView file
•path = bin/rotom-up.sh
kind = build_helper
sizeBytes = 14370
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
bin/rotom-up.shView on unpkgdist/master/dashboard/favicon.icoView file
•path = dist/master/dashboard/favicon.ico
kind = high_entropy_blob
sizeBytes = 9316
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/master/dashboard/favicon.icoView on unpkgdist/master/dashboard/assets/ts.worker-BhkL8olL.jsView file
•path = dist/master/dashboard/assets/ts.worker-BhkL8olL.js
kind = oversized_source_file
sizeBytes = 6023473
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/master/dashboard/assets/ts.worker-BhkL8olL.jsView on unpkgFindings
3 High5 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobdist/master/dashboard/favicon.ico
HighOversized Source Filedist/master/dashboard/assets/ts.worker-BhkL8olL.js
MediumDynamic Requiredist/cli/join.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/rotom-up.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/master/repo-scan.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License