registry / @linghun/tools / 0.1.5

@linghun/tools@0.1.5

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 140 KB of source, external domains: cn.bing.com

Source & flagged code

1 flagged

dist/chunk-4UHQWBFA.jsView file

Lines 1-24javascript

1// src/tools/WebFetch/web-fetch.ts

2var FETCH_TIMEOUT_MS = 3e4;

3var MAX_CONTENT_LENGTH = 5e4;

4var MAX_RESPONSE_SIZE = 5 * 1024 * 1024;

5async function webFetch(input) {

6 const urlError = validateUrl(input.url);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-4UHQWBFA.jsView on unpkg · L4

7 if (urlError) return { ok: false, error: urlError };

8 const url = input.url.startsWith("http://") ? input.url : input.url;

9 const controller = new AbortController();

10 const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);

11 try {

12 const response = await fetch(url, {

13 method: "GET",

14 headers: {

15 "Accept": "text/html,application/xhtml+xml,text/plain,*/*",

16 "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8",

17 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"

18 },

19 signal: controller.signal,

20 redirect: "follow"

21 });

22 clearTimeout(timer);

23 const contentType = response.headers.get("content-type") || null;

24 let body = "";

Source & flagged code

1 flagged · loading source

dist/chunk-4UHQWBFA.jsView file

4var MAX_RESPONSE_SIZE = 5 * 1024 * 1024; L5: async function webFetch(input) { L6: const urlError = validateUrl(input.url); ... L32: } L33: const decoder = new TextDecoder("utf-8", { fatal: false }); L34: let totalBytes = 0; ... L133: text: `WebFetch failed for "${url}": ${result.error}`, L134: data: { L135: url,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-4UHQWBFA.jsView on unpkg · L4

Findings

1 High2 Medium4 Low

HighCloud Metadata Accessdist/chunk-4UHQWBFA.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/chunk-4UHQWBFA.jsView file

Lines 1-24javascript

1// src/tools/WebFetch/web-fetch.ts

2var FETCH_TIMEOUT_MS = 3e4;

3var MAX_CONTENT_LENGTH = 5e4;

4var MAX_RESPONSE_SIZE = 5 * 1024 * 1024;

5async function webFetch(input) {

6 const urlError = validateUrl(input.url);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-4UHQWBFA.jsView on unpkg · L4

7 if (urlError) return { ok: false, error: urlError };

8 const url = input.url.startsWith("http://") ? input.url : input.url;

9 const controller = new AbortController();

10 const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);

11 try {

12 const response = await fetch(url, {

13 method: "GET",

14 headers: {

15 "Accept": "text/html,application/xhtml+xml,text/plain,*/*",

16 "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8",

17 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"

18 },

19 signal: controller.signal,

20 redirect: "follow"

21 });

22 clearTimeout(timer);

23 const contentType = response.headers.get("content-type") || null;

24 let body = "";