registry / @magonxesp/osaka / 1.0.9

@magonxesp/osaka@1.0.9

⚠ Under review

Escrapeador de links de descarga de animes

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 305 file(s), 6.78 MB of source, external domains: 4pda.to, ad.jp.ap.valuecommerce.com, adclick.g.doubleclick.net, affiliate.suruga-ya.jp, affportal.bhphoto.com, al.dmm.co.jp, al.dmm.com, al.fanza.co.jp, amzn.to, animeav1.com, api2.zoomit.ir, app.adjust.com, atmedia.link, azrom.net, cadenaser.com, candyai.gg, cdn.plyr.io, cdns.6hiidude.gold, checklink.mail.ru, click.email4customers.com, click.linksynergy.com, click.mail.ru, clicker.mail.ru, clicks.trx-hub.com, cna.st, colab.research.google.com, consent.youtube.com, cts.businesswire.com, datatracker.ietf.org, deeplink.musescore.com, disq.us, dq.h1g.jp, dragontea.ink, drivevideo.xyz, ensonhaber.me, fsx.i-run.fr, gate.sc, github.com, go.2038.pro, go.redirectingat.com, go.rmhfrtnd.com, go.skimresources.com, googleads.g.doubleclick.net, hamtamovie.nl, hb.afl.rakuten.co.jp, html-load.com, i.imgur.com, imgprime.com, invol.co, l.vrgl.ir

Source & flagged code

3 flagged

ubol-extension/rulesets/scripting/scriptlet/main/ublock-badware.jsView file

Lines 1511-1551javascript

1511 if ( extraArgs.as !== undefined ) {

1512 if ( extraArgs.as === 'function' ) {

1513 return ( ) => value;

1514 } else if ( extraArgs.as === 'callback' ) {

1515 return ( ) => (( ) => value);

1516 } else if ( extraArgs.as === 'resolved' ) {

1517 return Promise.resolve(value);

1518 } else if ( extraArgs.as === 'rejected' ) {

1519 return Promise.reject(value);

1520 }

1521 }

1522 return value;

1523}

1524

1525/******************************************************************************/

1526

1527const scriptletGlobals = {}; // eslint-disable-line

1528

1529const $scriptletFunctions$ = /* 6 */

1530[preventAddEventListener,noEvalIf,abortCurrentScript,trustedReplaceArgument,abortOnStackTrace,jsonEditFetchResponse];

1531

1532const $scriptletArgs$ = /* 21 */ ["DOMContentLoaded","fullscreenEnabled","tigervip2","atob","new Function(atob(","String.prototype.includes","0","undefined","condition","/^checkout$/","WebSocket","event.data","XMLHttpRequest","/wp-content","open","executeCode","Array.prototype.indexOf","isWin",".result.items.*[?.content*=\"

1533

Low

Eval

Package source references a known benign dynamic code generation pattern.

ubol-extension/rulesets/scripting/scriptlet/main/ublock-badware.jsView on unpkg · L1531

1534const $scriptletArglists$ = /* 9 */ "0,0,1;1,2;2,3,4;3,5,6,7,8,9;2,10,11;4,12,13;2,14,15;4,16,17;5,18,19,20";

1535

1536const $scriptletArglistRefs$ = /* 27 */ "8;4;4;3;4;4;2;4;3;4;4;5;4;4;4;4;4;4;6;4;4;3;1;7;3;0;2";

1537

1538const $scriptletHostnames$ = /* 27 */ ["comix.to","ojworld.it","forqueen.cz","red17.co.uk","tvojstyl.sk","up-shop.org","crimsonav.com","adrissa.com.co","lundracing.com","jollibee.com.vn","kitapsan.com.tr","rapidkil.com.au","yairalon.com.br","joinusonline.net","mebelinovdom.com","qualityrental.com","szaszmotorshop.hu","americansoda.co.uk","weightlossdiet.top",

1539

1540const $scriptletFromRegexes$ = /* 0 */ [];

1541

1542const $hasEntities$ = false;

1543const $hasAncestors$ = false;

1544const $hasRegexes$ = false;

1545

1546/******************************************************************************/

1547

1548const entries = (( ) => {

1549 const docloc = document.location;

1550 const origins = [ docloc.origin ];

1551 if ( docloc.ancestorOrigins ) {

ubol-extension/rulesets/scripting/scriptlet/main/ublock-filters.jsView file

16You should have received a copy of the GNU General Public License L17: along with this program. If not, see {http://www.gnu.org/licenses/}. L18: ... L35: this.separatorChar = this.actualSeparatorChar = separatorChar; L36: this.separatorCode = this.actualSeparatorCode = separatorChar.charCodeAt(0); L37: this.mustQuote = mustQuote; ... L655: const [ , mime, content ] = L656: /^data:([^,]*),(.+)$/.exec(elem.src.trim()) || L657: [ '', '', '' ]; ... L1459: }; L1460: self.fetch = new Proxy(self.fetch, { L1461: apply: applyHandler

Critical

Global Object Hijack Exfiltration

Source reassigns a global/builtin to a Proxy that forwards intercepted runtime data to an external endpoint.

ubol-extension/rulesets/scripting/scriptlet/main/ublock-filters.jsView on unpkg · L16

ubol-extension/css/fonts/Inter/Inter-Regular.woff2View file

•path = ubol-extension/css/fonts/Inter/Inter-Regular.woff2 kind = high_entropy_blob sizeBytes = 111268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ubol-extension/css/fonts/Inter/Inter-Regular.woff2View on unpkg

Source & flagged code

3 flagged · loading source

ubol-extension/rulesets/scripting/scriptlet/main/ublock-badware.jsView file

1531L1532: const $scriptletArgs$ = /* 21 */ ["DOMContentLoaded","fullscreenEnabled","tigervip2","atob","new Function(atob(","String.prototype.includes","0","undefined","condition","/^checkout... L1533:

Low

Eval

Package source references a known benign dynamic code generation pattern.

ubol-extension/rulesets/scripting/scriptlet/main/ublock-badware.jsView on unpkg · L1531

ubol-extension/rulesets/scripting/scriptlet/main/ublock-filters.jsView file

Critical

Global Object Hijack Exfiltration

Source reassigns a global/builtin to a Proxy that forwards intercepted runtime data to an external endpoint.

ubol-extension/rulesets/scripting/scriptlet/main/ublock-filters.jsView on unpkg · L16

ubol-extension/css/fonts/Inter/Inter-Regular.woff2View file

•path = ubol-extension/css/fonts/Inter/Inter-Regular.woff2 kind = high_entropy_blob sizeBytes = 111268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ubol-extension/css/fonts/Inter/Inter-Regular.woff2View on unpkg

Findings

1 Critical1 High3 Medium7 Low

CriticalGlobal Object Hijack Exfiltrationubol-extension/rulesets/scripting/scriptlet/main/ublock-filters.js

HighShips High Entropy Blobubol-extension/css/fonts/Inter/Inter-Regular.woff2

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalubol-extension/rulesets/scripting/scriptlet/main/ublock-badware.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

ubol-extension/rulesets/scripting/scriptlet/main/ublock-badware.jsView file

Lines 1511-1551javascript

1511 if ( extraArgs.as !== undefined ) {

1512 if ( extraArgs.as === 'function' ) {

1513 return ( ) => value;

1514 } else if ( extraArgs.as === 'callback' ) {

1515 return ( ) => (( ) => value);

1516 } else if ( extraArgs.as === 'resolved' ) {

1517 return Promise.resolve(value);

1518 } else if ( extraArgs.as === 'rejected' ) {

1519 return Promise.reject(value);

1520 }

1521 }

1522 return value;

1523}

1524

1525/******************************************************************************/

1526

1527const scriptletGlobals = {}; // eslint-disable-line

1528

1529const $scriptletFunctions$ = /* 6 */

1530[preventAddEventListener,noEvalIf,abortCurrentScript,trustedReplaceArgument,abortOnStackTrace,jsonEditFetchResponse];

1531

1533

Low

Eval

Package source references a known benign dynamic code generation pattern.

ubol-extension/rulesets/scripting/scriptlet/main/ublock-badware.jsView on unpkg · L1531

1534const $scriptletArglists$ = /* 9 */ "0,0,1;1,2;2,3,4;3,5,6,7,8,9;2,10,11;4,12,13;2,14,15;4,16,17;5,18,19,20";

1535

1536const $scriptletArglistRefs$ = /* 27 */ "8;4;4;3;4;4;2;4;3;4;4;5;4;4;4;4;4;4;6;4;4;3;1;7;3;0;2";

1537

1539

1540const $scriptletFromRegexes$ = /* 0 */ [];

1541

1542const $hasEntities$ = false;

1543const $hasAncestors$ = false;

1544const $hasRegexes$ = false;

1545

1546/******************************************************************************/

1547

1548const entries = (( ) => {

1549 const docloc = document.location;

1550 const origins = [ docloc.origin ];

1551 if ( docloc.ancestorOrigins ) {

ubol-extension/rulesets/scripting/scriptlet/main/ublock-filters.jsView file

Critical

Global Object Hijack Exfiltration

Source reassigns a global/builtin to a Proxy that forwards intercepted runtime data to an external endpoint.

ubol-extension/rulesets/scripting/scriptlet/main/ublock-filters.jsView on unpkg · L16

ubol-extension/css/fonts/Inter/Inter-Regular.woff2View file

•path = ubol-extension/css/fonts/Inter/Inter-Regular.woff2 kind = high_entropy_blob sizeBytes = 111268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ubol-extension/css/fonts/Inter/Inter-Regular.woff2View on unpkg