registry / @patchstack/connect / 0.3.24

@patchstack/connect@0.3.24

Patchstack connector for JavaScript applications. Scans your lockfile and reports installed packages to Patchstack for vulnerability monitoring.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 820 KB of source, external domains: api.patchstack.com, app.patchstack.com, cdn.patchstack.com, patchstack.com, patchstack.local

Source & flagged code

4 flagged

dist/protect.edge.jsView file

Lines 1-26javascript

1var __create = Object.create;

2var __defProp = Object.defineProperty;

3var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __getProtoOf = Object.getPrototypeOf;

6var __hasOwnProp = Object.prototype.hasOwnProperty;

7var __commonJS = (cb, mod) => function __require() {

8 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

9};

10var __copyProps = (to, from, except, desc) => {

11 if (from && typeof from === "object" || typeof from === "function") {

12 for (let key of __getOwnPropNames(from))

13 if (!__hasOwnProp.call(to, key) && key !== except)

14 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

15 }

16 return to;

17};

18var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

19 // If the importer is in node compatibility mode or this is not an ESM

20 // file that has been converted to a CommonJS file using a Babel-

21 // compatible transform (i.e. "__esModule" has not been set), then set

22 // "default" to the CommonJS "module.exports" for node compatibility.

23 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

24 mod

25));

Lines 37-77javascript

37 const u = new URL(value);

38 if (u.protocol === "https:") return true;

39 return u.protocol === "http:" &&

dist/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: const segments = pkgPath.split("node_modules" + path2.sep === pkgPath ? path2.sep : "/"); const nmIndex = parts.lastIndexOf("node_modules"); const nmCount = parts.filter((p) => p === "node_modules").length; // src/parsers/node_modules.ts const root = path3.join(cwd, "node_modules"); `node_modules/ not found at ${cwd}. Install dependencies first (e.g. \`bun install\` or \`npm install\`).`, const nested = path3.join(pkgDir, "node_modules"); warnings.push(staleWarning("node_modules/", missing));

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

dist/protect.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @patchstack/connect@0.3.20 matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.3.20 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/protect.cjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/protect.edge.jsView file

@patchstack/connect@0.3.24

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code