Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcedist/bin/afw.jsView file
5import process$1 from "node:process";
L6: import { execFileSync, spawn } from "node:child_process";
L7: import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, sep } from "node:path";
High
1871if (process$2.versions?.electron) parseOptions$1.from = "electron";
L1872: const execArgv = process$2.execArgv ?? [];
L1873: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions$1.from = "eval";
High
5import process$1 from "node:process";
L6: import { execFileSync, spawn } from "node:child_process";
L7: import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, sep } from "node:path";
...
L13: import { parse } from "jsonc-parser";
L14: import { createServer } from "node:http";
L15: import { Buffer as Buffer$1 } from "node:buffer";
...
L24: import { join as join$1 } from "path";
L25: import { gunzipSync, gzipSync } from "node:zlib";
L26: import Database from "better-sqlite3";
...
L68: * Constructs the CommanderError class
L69: * @param {number} exitCode suggested exit code which could be used with process.exit
L70: * @param {string} code an id string representing the error
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/bin/afw.jsView on unpkg · L5dist/bin/tap.jsView file
20const SERVER = readFlag(flags, "--server") ?? "unknown";
L21: const DAEMON_URL = process.env.AFW_DAEMON_URL ?? "http://localhost:9877";
L22: const child = spawn(cmd, cmdArgs, { stdio: [
L23: "pipe",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/tap.jsView on unpkg · L208if (sep < 0) {
L9: process.stderr.write("afw-tap: missing -- separator; expected --agent X --server Y -- <cmd> [args...]\n");
L10: process.exit(2);
...
L20: const SERVER = readFlag(flags, "--server") ?? "unknown";
L21: const DAEMON_URL = process.env.AFW_DAEMON_URL ?? "http://localhost:9877";
L22: const child = spawn(cmd, cmdArgs, { stdio: [
L23: "pipe",
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/bin/tap.jsView on unpkg · L8dist/bin/tools.jsView file
6//#region src/core/web-search/fetch.ts
L7: const FETCH_USER_AGENT = "afw-tools/0.1 (+https://openafw.com)";
L8: const DEFAULT_MAX_BYTES = 1024 * 1024;
...
L51: }
L52: /** Reject URLs that point at the local machine, private networks,
L53: * link-local space, or cloud metadata endpoints. Operates on the URL
...
L143: return {
L144: text: new TextDecoder("utf-8", { fatal: false }).decode(merged),
L145: truncated
...
L214: function send(msg) {
L215: process.stdout.write(`${JSON.stringify(msg)}\n`);
L216: }
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/bin/tools.jsView on unpkg · L6Findings
5 High4 Medium4 Low
HighChild Processdist/bin/afw.js
HighShelldist/bin/afw.js
HighSame File Env Network Executiondist/bin/tap.js
HighCommand Output Exfiltrationdist/bin/tap.js
HighCloud Metadata Accessdist/bin/tools.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/bin/afw.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings