Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flagged · loading sourcemain.jsView file
11143patternName = google_api_key
severity = high
line = 11143
matchedText = apiKey: ...Lk",
High
10755module2.exports = (string4, columns, options2) => {
L10756: return String(string4).normalize().replace(/\r\n/g, "\n").split("\n").map((line) => exec(line, columns, options2)).join("\n");
L10757: };
High
11107module2.exports = (string4, columns, options2) => {
L11108: return String(string4).normalize().replace(/\r\n/g, "\n").split("\n").map((line) => exec(line, columns, options2)).join("\n");
L11109: };
...
L11119: var import_path = require("path");
L11120: var EMULATOR_API_GATEWAY_PORT = process.env.CUE_EMULATOR_API_GATEWAY_PORT ?? "18093";
L11121: var EMULATOR_API_GATEWAY_BASE = `http://localhost:${EMULATOR_API_GATEWAY_PORT}`;
L11122: var TOKEN_ENDPOINT_EMULATOR = `${EMULATOR_API_GATEWAY_BASE}/token`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
main.jsView on unpkg · L11107•matchType = previous_version_dangerous_delta
matchedPackage = @qaecy/cue-cli@0.0.50
matchedIdentity = npm:QHFhZWN5L2N1ZS1jbGk:0.0.50
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
main.jsView on unpkg11143patternName = google_api_key
severity = high
line = 11143
matchedText = apiKey: ...Lk",
High
15851patternName = google_api_key
severity = high
line = 15851
matchedText = apiKey: ...l0",
High
3296sourceCode = this.opts.code.process(sourceCode, sch);
L3297: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L3298: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
main.jsView on unpkg · L3296hash-worker.jsView file
1// apps/desktop/cue-cli/src/hash-worker.js
L2: var { parentPort } = require("worker_threads");
L3: var { createReadStream } = require("fs");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
hash-worker.jsView on unpkg · L1assets/wasm/dir_scanner_wasm_bg.wasmView file
•path = assets/wasm/dir_scanner_wasm_bg.wasm
kind = wasm_module
sizeBytes = 380698
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
assets/wasm/dir_scanner_wasm_bg.wasmView on unpkgFindings
6 High5 Medium5 Low
HighHigh Secretmain.js
HighChild Processmain.js
HighSame File Env Network Executionmain.js
HighPrevious Version Dangerous Deltamain.js
HighSecret Patternmain.js
HighSecret Patternmain.js
MediumDynamic Requirehash-worker.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleassets/wasm/dir_scanner_wasm_bg.wasm
MediumStructural Risk Force Deep Review
LowEvalmain.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License