registry / @leofcoin/chain / 1.10.14
@leofcoin/chain@1.10.14
⚠ Under reviewOfficial javascript implementation
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggedexports/browser/chain.jsView file
3526return new Promise((resolve, reject) => {
L3527: import('child_process').then(({ fork }) => {
L3528: const child = fork(url, ['easy-worker-child'], options);
High
Child Process
Package source references child process execution.
exports/browser/chain.jsView on unpkg · L3526160Cross-file remote execution chain: exports/browser/chain.js spawns exports/browser/workers/machine-worker.js; helper contains network access plus dynamic code execution.
L160: typeof process === 'object' &&
L161: process.env &&
L162: process.env.NODE_DEBUG &&
...
L3104: let nonce = await globalThis.accountsStore.get(address);
L3105: nonce = Number(new TextDecoder().decode(nonce));
L3106: const maxPending = this.getMaxPendingNonce(address);
...
L3157: }
L3158: async sendTransaction(message) {
L3159: if (!this.isTransactionMessage(message)) message = await new TransactionMessage(message);
...
L3526: return new Promise((resolve, reject) => {
L3527: import('child_process').then(({ fork }) => {
L3528: const child = fork(url, ['easy-worker-child'], options);
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
exports/browser/chain.jsView on unpkg · L160Findings
2 High3 Medium6 Low
HighChild Processexports/browser/chain.js
HighCross File Remote Execution Contextexports/browser/chain.js
MediumDynamic Requireexports/browser/index-CPQ5yvZ2.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvalexports/browser/workers/machine-worker.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @leofcoin/chain@1.10.14.
See all versions of @leofcoin/chain for other recorded verdicts.
- Review the evidence and your use of @leofcoin/chain@1.10.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.