registry / @monster-orange/den
@monster-orange/den
⚠ Under reviewDen: a local multi-repo dev orchestrator, HTTPS edge and E2E harness
This report shows the evidence for @monster-orange/den@0.2.1. 0 of 2 known versions are blocked or flagged. See all versions.
Static Scan Results
scanned 28m ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/shared/environment-manager/derivation/cache.tsView file
57const raw = fs.readFileSync(CACHE_PATH, "utf-8");
L58: const parsed = JSON.parse(raw) as CacheFile;
L59: if (parsed.version !== CACHE_VERSION)
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/shared/environment-manager/derivation/cache.tsView on unpkg · L57src/shared/auth/token-providers/auth0.tsView file
40L41: const body: Record<string, string> = {
L42: grant_type: "password",
...
L47: client_id: clientId,
L48: realm: process.env.E2E_AUTH0_REALM ?? "Username-Password-Authentication",
L49: };
...
L57:
L58: const response = await fetch(`https://${domain}/oauth/token`, {
L59: method: "POST",
...
L64:
L65: const data = (await response.json()) as RopcResponse;
L66:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/shared/auth/token-providers/auth0.tsView on unpkg · L40Findings
2 Critical1 High4 Medium6 Low
CriticalCredential Exfiltrationsrc/shared/auth/token-providers/auth0.ts
CriticalPrevious Version Dangerous Deltasrc/shared/environment-manager/health.ts
HighSemantic Analysis Limitedbin/den
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpermake/demo.mk
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/shared/environment-manager/derivation/cache.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @monster-orange/den@0.2.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @monster-orange/den@0.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.