@nimbus21.ai/the-link@3.16.2: Suspicious npm security report

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 1.10 MB of source, external domains: 127.0.0.1, github.com, metcoder.dev, opencollective.com, s.io, www.apple.com

Source & flagged code

5 flagged

bin/the-link.jsView file

28`;else if(K){let V=t3(H,K);if(V)Z.headers=Z.headers.replace(Lo,`baggage: ${V}\r L29: `)}}}function Mo(Z,J){let Q=nf0(Z),$=J.statusCode,X=o3($);g1({category:"http",data:{status_code:$,...Q},type:"http",level:X},{event:"response",request:Z,response:J})}function nf0(Z... L30: `).some((Q)=>Q.indexOf("(https.js:")!==-1||Q.indexOf("node:https:")!==-1)}createSocket(Z,J,Q){let $={...J,secureEndpoint:this.isSecureEndpoint(J)};Promise.resolve().then(()=>this.c...

High

Child Process

Package source references child process execution.

bin/the-link.jsView on unpkg · L28

16Error:`,X)}}var TK,Xd;var EK=q(()=>{V0();J0();O7();TK={},Xd={}});function Yd(Z){MJ("error",Z),RJ("error",xA0)}function xA0(){zq=d.onerror,d.onerror=function(Z,J,Q,$,X){if(NJ("error... L17: `)}var Pd=q(()=>{Dq()});function Oq(Z,J,Q){let $,X,Y,W=Q?.maxWait?Math.max(Q.maxWait,J):0,K=Q?.setTimeoutImpl||setTimeout;function z(){return G(),$=Z(),$}function G(){X!==void 0&&c... L18: Event: ${uZ(Z)}`),!0;if(Bk0(Z))return R&&O.warn(`Event dropped due to not having an error message, error type or stacktrace. ... L24: Event: ${uZ(Z)}`),!0}return!1}function Kk0(Z,J){if(!J?.length)return!1;return PK(Z).some((Q)=>mZ(Q,J))}function zk0(Z,J){if(!J?.length)return!1;let Q=Z.transaction;return Q?mZ(Q,J)... L25: ${X.stack}`:"unknown"}}}}}var WP0=10,KP0="ZodErrors",FP0=(Z={})=>{let J=Z.limit??WP0;return{name:KP0,processEvent(Q,$){return BP0(J,Z.saveZodIssuesAsAttachment,Q,$)}}},P3;var Fc=q(... L26: `;if(z&&!G.includes("traceparent:"))Z.headers+=`traceparent: ${z}\r ... L28: `;else if(K){let V=t3(H,K);if(V)Z.headers=Z.headers.replace(Lo,`baggage: ${V}\r L29: `)}}}function Mo(Z,J){let Q=nf0(Z),$=J.statusCode,X=o3($);g1({category:"http",data:{status_code:$,...Q},type:"http",level:X},{event:"response",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/the-link.jsView on unpkg · L16

16patternName = generic_password severity = medium line = 16 matchedText = Error:`,...in(`

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/the-link.jsView on unpkg · L16

2// @bun L3: var CY0=Object.create;var{getPrototypeOf:MY0,defineProperty:H$,getOwnPropertyNames:uM,getOwnPropertyDescriptor:RY0}=Object,lM=Object.prototype.hasOwnProperty;function pM(Z){return ... L4: `).join(` ... L6: `)}function SC0(Z){if(Z)process.env.DEBUG=Z;else delete process.env.DEBUG}function _C0(){return process.env.DEBUG}function yC0(Z){Z.inspectOpts={};let J=Object.keys(ov.inspectOpts)... L7: `).map((J)=>J.trim()).join(" ")};iv.O=function(Z){return this.inspectOpts.colors=this.useColors,cW.inspect(Z,this.inspectOpts)}});var sv=w((E81,AF)=>{if(typeof process>"u"||process... L8: `);for(let K=$;K<W.length;K++){let z=W[K];if(z.length>1024)z=z.slice(0,1024);let G=Tx.test(z)?z.replace(Tx,"$1"):z;if(G.match(/\S*Error: /))continue;for(let H of J){let V=H(G);if(V... ... L12: `),typeof K==="string"||K instanceof Uint8Array)X(K);else{let z;try{z=JSON.stringify(K)}catch{z=JSON.stringify(n0(K))}X(z)}}return typeof $==="string"?$:oN0($)}function oN0(Z){let ... L13: Reason: ${B}`)})}_process(Z,J){this._numProcessing++,this._promiseBuffer.add(Z).then((Q)=>{return this._numProcessing--,Q},(Q)=>{if(this._numProcessing--,Q===D3)this.recordDroppedE... L14: Type: ${Z} ... L28: `;else if(K

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/the-link.jsView on unpkg · L2

vendor/tmux-linux-x64View file

•path = vendor/tmux-linux-x64 kind = native_binary sizeBytes = 1308352 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/tmux-linux-x64View on unpkg

Source & flagged code

5 flagged · loading source

bin/the-link.jsView file

28`;else if(K){let V=t3(H,K);if(V)Z.headers=Z.headers.replace(Lo,`baggage: ${V}\r L29: `)}}}function Mo(Z,J){let Q=nf0(Z),$=J.statusCode,X=o3($);g1({category:"http",data:{status_code:$,...Q},type:"http",level:X},{event:"response",request:Z,response:J})}function nf0(Z... L30: `).some((Q)=>Q.indexOf("(https.js:")!==-1||Q.indexOf("node:https:")!==-1)}createSocket(Z,J,Q){let $={...J,secureEndpoint:this.isSecureEndpoint(J)};Promise.resolve().then(()=>this.c...

High

Child Process

Package source references child process execution.

bin/the-link.jsView on unpkg · L28

16Error:`,X)}}var TK,Xd;var EK=q(()=>{V0();J0();O7();TK={},Xd={}});function Yd(Z){MJ("error",Z),RJ("error",xA0)}function xA0(){zq=d.onerror,d.onerror=function(Z,J,Q,$,X){if(NJ("error... L17: `)}var Pd=q(()=>{Dq()});function Oq(Z,J,Q){let $,X,Y,W=Q?.maxWait?Math.max(Q.maxWait,J):0,K=Q?.setTimeoutImpl||setTimeout;function z(){return G(),$=Z(),$}function G(){X!==void 0&&c... L18: Event: ${uZ(Z)}`),!0;if(Bk0(Z))return R&&O.warn(`Event dropped due to not having an error message, error type or stacktrace. ... L24: Event: ${uZ(Z)}`),!0}return!1}function Kk0(Z,J){if(!J?.length)return!1;return PK(Z).some((Q)=>mZ(Q,J))}function zk0(Z,J){if(!J?.length)return!1;let Q=Z.transaction;return Q?mZ(Q,J)... L25: ${X.stack}`:"unknown"}}}}}var WP0=10,KP0="ZodErrors",FP0=(Z={})=>{let J=Z.limit??WP0;return{name:KP0,processEvent(Q,$){return BP0(J,Z.saveZodIssuesAsAttachment,Q,$)}}},P3;var Fc=q(... L26: `;if(z&&!G.includes("traceparent:"))Z.headers+=`traceparent: ${z}\r ... L28: `;else if(K){let V=t3(H,K);if(V)Z.headers=Z.headers.replace(Lo,`baggage: ${V}\r L29: `)}}}function Mo(Z,J){let Q=nf0(Z),$=J.statusCode,X=o3($);g1({category:"http",data:{status_code:$,...Q},type:"http",level:X},{event:"response",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/the-link.jsView on unpkg · L16

16patternName = generic_password severity = medium line = 16 matchedText = Error:`,...in(`

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/the-link.jsView on unpkg · L16

2// @bun L3: var CY0=Object.create;var{getPrototypeOf:MY0,defineProperty:H$,getOwnPropertyNames:uM,getOwnPropertyDescriptor:RY0}=Object,lM=Object.prototype.hasOwnProperty;function pM(Z){return ... L4: `).join(` ... L6: `)}function SC0(Z){if(Z)process.env.DEBUG=Z;else delete process.env.DEBUG}function _C0(){return process.env.DEBUG}function yC0(Z){Z.inspectOpts={};let J=Object.keys(ov.inspectOpts)... L7: `).map((J)=>J.trim()).join(" ")};iv.O=function(Z){return this.inspectOpts.colors=this.useColors,cW.inspect(Z,this.inspectOpts)}});var sv=w((E81,AF)=>{if(typeof process>"u"||process... L8: `);for(let K=$;K<W.length;K++){let z=W[K];if(z.length>1024)z=z.slice(0,1024);let G=Tx.test(z)?z.replace(Tx,"$1"):z;if(G.match(/\S*Error: /))continue;for(let H of J){let V=H(G);if(V... ... L12: `),typeof K==="string"||K instanceof Uint8Array)X(K);else{let z;try{z=JSON.stringify(K)}catch{z=JSON.stringify(n0(K))}X(z)}}return typeof $==="string"?$:oN0($)}function oN0(Z){let ... L13: Reason: ${B}`)})}_process(Z,J){this._numProcessing++,this._promiseBuffer.add(Z).then((Q)=>{return this._numProcessing--,Q},(Q)=>{if(this._numProcessing--,Q===D3)this.recordDroppedE... L14: Type: ${Z} ... L28: `;else if(K

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/the-link.jsView on unpkg · L2

vendor/tmux-linux-x64View file

•path = vendor/tmux-linux-x64 kind = native_binary sizeBytes = 1308352 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/tmux-linux-x64View on unpkg

Findings

2 High6 Medium5 Low

HighChild Processbin/the-link.js

HighSame File Env Network Executionbin/the-link.js

MediumSecret Patternbin/the-link.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/the-link.js

MediumShips Native Binaryvendor/tmux-linux-x64

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License