registry  /  @mobkit/cli  /  0.5.2

@mobkit/cli@0.5.2

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 1 file(s), 1.60 MB of source, external domains: community.apicloud.com, github.com, jimmy.warting.se, json-schema.org, open.diwork.com, raw.githubusercontent.com, www.w3.org

Source & flagged code

6 flagged · loading source
dist/mobkit.mjsView file
1#!/usr/bin/env node L2: import{createRequire as ds}from"node:module";var ns=Object.create;var{getPrototypeOf:ks,defineProperty:uW,getOwnPropertyNames:is}=Object;var hs=Object.prototype.hasOwnProperty;func... L3: `);$=Y.pop()??"";for(let N of Y)if(N.trim())B(N)}),D.on("error",C),D.on("close",()=>{if($.trim())B($);g()})})}async function as(A,Q,B){return new Promise((E,I)=>{let g=cW(A,Q,{sign...
High
Child Process

Package source references child process execution.

dist/mobkit.mjsView on unpkg · L1
1#!/usr/bin/env node L2: import{createRequire as ds}from"node:module";var ns=Object.create;var{getPrototypeOf:ks,defineProperty:uW,getOwnPropertyNames:is}=Object;var hs=Object.prototype.hasOwnProperty;func... L3: `);$=Y.pop()??"";for(let N of Y)if(N.trim())B(N)}),D.on("error",C),D.on("close",()=>{if($.trim())B($);g()})})}async function as(A,Q,B){return new Promise((E,I)=>{let g=cW(A,Q,{sign... L4: `).slice(1)){let E=B.trim();if(!E)continue;let[I,g,...C]=E.split(/\s+/);if(!I||!g)continue;let D=Object.fromEntries(C.map((F)=>F.split(":")).filter((F)=>F.length===2)),$=g==="devic... L5: `).map((B)=>B.trim()).filter((B)=>B&&B!=="[Empty]");return Promise.all(Q.map(async(B)=>({id:B,platform:"harmony",name:await AV(B,"const.product.model")??B,model:await AV(B,"const.p... L6: `).join(`\r
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mobkit.mjsView on unpkg · L1
1#!/usr/bin/env node L2: import{createRequire as ds}from"node:module";var ns=Object.create;var{getPrototypeOf:ks,defineProperty:uW,getOwnPropertyNames:is}=Object;var hs=Object.prototype.hasOwnProperty;func... L3: `);$=Y.pop()??"";for(let N of Y)if(N.trim())B(N)}),D.on("error",C),D.on("close",()=>{if($.trim())B($);g()})})}async function as(A,Q,B){return new Promise((E,I)=>{let g=cW(A,Q,{sign... L4: `).slice(1)){let E=B.trim();if(!E)continue;let[I,g,...C]=E.split(/\s+/);if(!I||!g)continue;let D=Object.fromEntries(C.map((F)=>F.split(":")).filter((F)=>F.length===2)),$=g==="devic... L5: `).map((B)=>B.trim()).filter((B)=>B&&B!=="[Empty]");return Promise.all(Q.map(async(B)=>({id:B,platform:"harmony",name:await AV(B,"const.product.model")??B,model:await AV(B,"const.p... L6: `).join(`\r
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mobkit.mjsView on unpkg · L1
1#!/usr/bin/env node L2: import{createRequire as ds}from"node:module";var ns=Object.create;var{getPrototypeOf:ks,defineProperty:uW,getOwnPropertyNames:is}=Object;var hs=Object.prototype.hasOwnProperty;func... L3: `);$=Y.pop()??"";for(let N of Y)if(N.trim())B(N)}),D.on("error",C),D.on("close",()=>{if($.trim())B($);g()})})}async function as(A,Q,B){return new Promise((E,I)=>{let g=cW(A,Q,{sign... L4: `).slice(1)){let E=B.trim();if(!E)continue;let[I,g,...C]=E.split(/\s+/);if(!I||!g)continue;let D=Object.fromEntries(C.map((F)=>F.split(":")).filter((F)=>F.length===2)),$=g==="devic... L5: `).map((B)=>B.trim()).filter((B)=>B&&B!=="[Empty]");return Promise.all(Q.map(async(B)=>({id:B,platform:"harmony",name:await AV(B,"const.product.model")??B,model:await AV(B,"const.p... L6: `).join(`\r ... L12: `).some((g)=>g.includes(I)))throw new O("device/webview-not-debuggable",`pid ${B} 没有 webview_devtools_remote socket——该 WebView 未开启调试`+"（Android 需 setWebContentsDebuggingEnabled(tru... L13: `)){let I=B.exec(E);if(I)return I[1]}return null}async function hAA(A,Q,B,E){let I=A==="hdc"?["fport","ls"]:["forward","--list"],{stdout:g}=await PA(A,[...JU(A,Q),...I],{timeoutMs:... L14: name:'\${1:}'
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/mobkit.mjsView on unpkg · L1
6315</html> L6316: `;function $R(A={}){let Q=A.html??Tu;if(Q=Q.replace(/__MOBKIT_NONCE_ATTR__/g,A.nonce?`nonce="${A.nonce}"`:""),Q=Q.replace("<!--__MOBKIT_CSP__-->",A.csp?`<meta http-equiv="Content-S... L6317: `)}var Dm=(A,Q)=>{A.name="$ZodError",Object.defineProperty(A,"_zod",{value:A._zod,enumerable:!1}),Object.defineProperty(A,"issues",{value:Q,enumerable:!1}),A.message=JSON.stringify...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/mobkit.mjsView on unpkg · L6315
1#!/usr/bin/env node L2: import{createRequire as ds}from"node:module";var ns=Object.create;var{getPrototypeOf:ks,defineProperty:uW,getOwnPropertyNames:is}=Object;var hs=Object.prototype.hasOwnProperty;func... L3: `);$=Y.pop()??"";for(let N of Y)if(N.trim())B(N)}),D.on("error",C),D.on("close",()=>{if($.trim())B($);g()})})}async function as(A,Q,B){return new Promise((E,I)=>{let g=cW(A,Q,{sign... L4: `).slice(1)){let E=B.trim();if(!E)continue;let[I,g,...C]=E.split(/\s+/);if(!I||!g)continue;let D=Object.fromEntries(C.map((F)=>F.split(":")).filter((F)=>F.length===2)),$=g==="devic... L5: `).map((B)=>B.trim()).filter((B)=>B&&B!=="[Empty]");return Promise.all(Q.map(async(B)=>({id:B,platform:"harmony",name:await AV(B,"const.product.model")??B,model:await AV(B,"const.p... L6: `).join(`\r ... L12: `).some((g)=>g.includes(I)))throw new O("device/webview-not-debuggable",`pid ${B} 没有 webview_devtools_remote socket——该 WebView 未开启调试`+"（Android 需 setWebContentsDebuggingEnabled(tru... L13: `)){let I=B.exec(E);if(I)return I[1]}return null}async function hAA(A,Q,B,E){let I=A==="hdc"?["fport","ls"]:["forward","--list"],{stdout:g}=await PA(A,[...JU(A,Q),...I],{timeoutMs:... L14: name:'\${1:}'
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/mobkit.mjsView on unpkg · L1

Findings

4 High3 Medium8 Low
HighChild Processdist/mobkit.mjs
HighSame File Env Network Executiondist/mobkit.mjs
HighCommand Output Exfiltrationdist/mobkit.mjs
HighObfuscated Payload Loaderdist/mobkit.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mobkit.mjs
LowWeak Cryptodist/mobkit.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License