registry / @leofcoin/chain / 1.10.8
@leofcoin/chain@1.10.8
Official javascript implementation
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsProtestwareTelemetryUrlStrings
Source & flagged code
2 flaggedexports/browser/workers/machine-worker.jsView file
287try {
L288: const func = new Function(new TextDecoder().decode(decoded.contract));
L289: const Contract = func();
Low
Eval
Package source references a known benign dynamic code generation pattern.
exports/browser/workers/machine-worker.jsView on unpkg · L287exports/browser/chain.jsView file
4679}
L4680: import(encoded) {
L4681: return base58$1.decode(encoded);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
exports/browser/chain.jsView on unpkg · L4679Findings
4 Medium6 Low
MediumDynamic Requireexports/browser/chain.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
LowScripts Present
LowEvalexports/browser/workers/machine-worker.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @leofcoin/chain@1.10.8.
See all versions of @leofcoin/chain for other recorded verdicts.
- Review the evidence and your use of @leofcoin/chain@1.10.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.