registry / @leofcoin/chain / 1.10.11
@leofcoin/chain@1.10.11
Official javascript implementation
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsProtestwareTelemetryUrlStrings
Source & flagged code
4 flaggedexports/browser/chain.jsView file
3524return new Promise((resolve, reject) => {
L3525: import('child_process').then(({ fork }) => {
L3526: const child = fork(url, ['easy-worker-child'], options);
High
Child Process
Package source references child process execution.
exports/browser/chain.jsView on unpkg · L3524160Cross-file remote execution chain: exports/browser/chain.js spawns exports/browser/workers/machine-worker.js; helper contains network access plus dynamic code execution.
L160: typeof process === 'object' &&
L161: process.env &&
L162: process.env.NODE_DEBUG &&
...
L3083: let nonce = await globalThis.accountsStore.get(address);
L3084: nonce = Number(new TextDecoder().decode(nonce));
L3085: const maxPending = this.getMaxPendingNonce(address);
...
L3136: }
L3137: async sendTransaction(message) {
L3138: if (!this.isTransactionMessage(message)) message = await new TransactionMessage(message);
...
L3524: return new Promise((resolve, reject) => {
L3525: import('child_process').then(({ fork }) => {
L3526: const child = fork(url, ['easy-worker-child'], options);
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
exports/browser/chain.jsView on unpkg · L160Findings
2 High4 Medium6 Low
HighChild Processexports/browser/chain.js
HighCross File Remote Execution Contextexports/browser/chain.js
MediumDynamic Requireexports/browser/node-browser-xlqSBOaN.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
LowScripts Present
LowEvalexports/browser/workers/machine-worker.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @leofcoin/chain@1.10.11.
See all versions of @leofcoin/chain for other recorded verdicts.
- Review the evidence and your use of @leofcoin/chain@1.10.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.