registry / @quotemedia.com/streamer / 2.70.0

@quotemedia.com/streamer@2.70.0

A JavaScript client for QuoteMedia's streaming data service.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.60 MB of source, external domains: bugzilla.mozilla.org, en.wikipedia.org, es5.github.com, es5.github.io, example.com, feross.org, fusesource.com, github.com, jmesnil.net, stackoverflow.com, usejsdoc.org, www.jmesnil.net

Source & flagged code

4 flagged

qmci-streamer-2.70.0.jsView file

29992var Url = require("url"); L29993: var spawn = require("child_process").spawn; L29994: var fs = require("fs");

High

Child Process

Package source references child process execution.

qmci-streamer-2.70.0.jsView on unpkg · L29992

6012parseJSON: function parseJSON(data) { L6013: return !data ? null : window.JSON && window.JSON.parse ? window.JSON.parse(data) : new Function("return " + data)(); L6014: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

qmci-streamer-2.70.0.jsView on unpkg · L6012

qmci-streamer-2.70.0.min.jsView file

Lines 80-115javascript

80 * precision sd |

81 * shiftedBy |

82 * squareRoot sqrt |

83 * toExponential |

84 * toFixed |

85 * toFormat |

86 * toFraction |

87 * toJSON |

88 * toNumber |

89 * toPrecision |

90 * toString |

91 * valueOf |

92 *

93 */var n,M=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,D=Math.ceil,L=Math.floor,R="[BigNumber Error] ",B=R+"Number primitive has more than 15 significant digits: ",k=1e14,U=14

94// Copyright Joyent, Inc. and other Node contributors.

95function(e){return Array.isArray?Array.isArray(e):"[object Array]"===f(e)},d.isBoolean=function(e){return"boolean"==typeof e},d.isNull=function(e){return null===e},d.isNullOrUndefined=function(e){return null==e},d.isNumber=function(e){return

96// Copyright Joyent, Inc. and other Node contributors.

97var f=Object.create||function(e){var t=function(){};return t.prototype=e,new t},d=Object.keys||function(e){var t=[];for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&t.push(n);return n},p

98// Copyright Joyent, Inc. and other Node contributors.

99"use strict";f.exports=function(e,t,n,r){t=t||"&",n=n||"=";var i={};if("string"!=typeof e||0===e.length)return i;var o=/\+/g;e=e.split

100// Copyright Joyent, Inc. and other Node contributors.

101"use strict";var f=function(e){switch(typeof e){case"string":return e;case"boolean":return e?"true":"false";case"number":return isFinite(e)?e:"";default:return""}};m.exports=function(n,r,

102// Copyright Joyent, Inc. and other Node contributors.

103"use strict";var f=S("process-nextick-args"),d=Object.keys||function(e){var t=[];for(var n in e)t.push(n);return t};v.exports=T;var p=S("core-util-is");p.inherits=S("inherits");var h=S("./_stream_readable"),m=S("./_stream_writable"

104// Copyright Joyent, Inc. and other Node contributors.

105"use strict";m.exports=p;var f=h("./_stream_transform"),d=h("core-util-is");function p(e){if(!(this instanceof p))return new p(e);f.call(this,e)}d.inherits=h("inherits"),d.inherits(p,f),p.prototype

106// Copyright Joyent, Inc. and other Node contributors.

107"use strict";var _=x("process-nextick-args");j.exports=w;var c,g=x("isarray");w.ReadableState=O;x("events").EventEmitter;var T=function(e,t){return e.listeners(t).length},f=x("./internal/streams/stream"),d=(l=x("safe-buffer").Buffer,e.Uint8Array||function(){});var p

108// Copyright Joyent, Inc. and other Node contributors.

109"use strict";_.exports=p;var f=E("./_stream_duplex"),d=E("core-util-is");function p(e){if(!(this instanceof p))return new p(e);f.call(this,e),this._transformState={afterTransform:function(

110// Copyright Joyent, Inc. and other Node contributors.

111"use strict";var g=C("process-nextick-args");function f(e){var t=this;this.next=null,this.entry=null,this.finish=function(){!function(e,t,n){var r=e.entry;e.entry=null;

112// Copyright Joyent, Inc. and other Node contributors.

113"use strict";var f=(n=y("safe-buffer").Buffer).isEncoding||function(e){switch((e=""+e)&&e.toLowerCase()){case"hex":case"utf8":case"utf-8":case"ascii":case"binary":case"base64":case"ucs2":case"ucs-2":

114// Copyright Joyent, Inc. and other Node contributors.

115"use strict";var L=h("punycode"),R=h("./util");function N(){this.protocol=null,this.slashes=null,this.auth=null,this.host=null,this.port=null,this.hostname=null,

Long lines were clipped for display.

README.mdView file

Lines 48-88markdown

482. Import the library:

49 ```javascript

50 var Streamer = require("<path to the library>");

51 ```

533. The library is ready for use in your `Node.js` project.

55## Quick Start

57```javascript

Source & flagged code

4 flagged · loading source

qmci-streamer-2.70.0.jsView file

29992var Url = require("url"); L29993: var spawn = require("child_process").spawn; L29994: var fs = require("fs");

High

Child Process

Package source references child process execution.

qmci-streamer-2.70.0.jsView on unpkg · L29992

6012parseJSON: function parseJSON(data) { L6013: return !data ? null : window.JSON && window.JSON.parse ? window.JSON.parse(data) : new Function("return " + data)(); L6014: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

qmci-streamer-2.70.0.jsView on unpkg · L6012

qmci-streamer-2.70.0.min.jsView file

100// Copyright Joyent, Inc. and other Node contributors. L101: "use strict";var f=function(e){switch(typeof e){case"string":return e;case"boolean":return e?"true":"false";case"number":return isFinite(e)?e:"";default:return""}};m.exports=functi... L102: // Copyright Joyent, Inc. and other Node contributors. ... L106: // Copyright Joyent, Inc. and other Node contributors. L107: "use strict";var _=x("process-nextick-args");j.exports=w;var c,g=x("isarray");w.ReadableState=O;x("events").EventEmitter;var T=function(e,t){return e.listeners(t).length},f=x("./in... L108: // Copyright Joyent, Inc. and other Node contributors. ... L114: // Copyright Joyent, Inc. and other Node contributors. L115: "use strict";var L=h("punycode"),R=h("./util");function N(){this.protocol=null,this.slashes=null,this.auth=null,this.host=null,this.port=null,this.hostname=null,this.hash=null,this...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

qmci-streamer-2.70.0.min.jsView on unpkg · L100

README.mdView file

68patternName = generic_password severity = medium line = 68 matchedText = password...ORD'

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L68

Findings

3 High4 Medium6 Low

HighChild Processqmci-streamer-2.70.0.js

HighShell

HighCommand Output Exfiltrationqmci-streamer-2.70.0.min.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowEvalqmci-streamer-2.70.0.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

qmci-streamer-2.70.0.jsView file

29992var Url = require("url"); L29993: var spawn = require("child_process").spawn; L29994: var fs = require("fs");

High

Child Process

Package source references child process execution.

qmci-streamer-2.70.0.jsView on unpkg · L29992

6012parseJSON: function parseJSON(data) { L6013: return !data ? null : window.JSON && window.JSON.parse ? window.JSON.parse(data) : new Function("return " + data)(); L6014: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

qmci-streamer-2.70.0.jsView on unpkg · L6012

qmci-streamer-2.70.0.min.jsView file

Lines 80-115javascript

80 * precision sd |

81 * shiftedBy |

82 * squareRoot sqrt |

83 * toExponential |

84 * toFixed |

85 * toFormat |

86 * toFraction |

87 * toJSON |

88 * toNumber |

89 * toPrecision |

90 * toString |

91 * valueOf |

92 *

93 */var n,M=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,D=Math.ceil,L=Math.floor,R="[BigNumber Error] ",B=R+"Number primitive has more than 15 significant digits: ",k=1e14,U=14

94// Copyright Joyent, Inc. and other Node contributors.

96// Copyright Joyent, Inc. and other Node contributors.

97var f=Object.create||function(e){var t=function(){};return t.prototype=e,new t},d=Object.keys||function(e){var t=[];for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&t.push(n);return n},p

98// Copyright Joyent, Inc. and other Node contributors.

99"use strict";f.exports=function(e,t,n,r){t=t||"&",n=n||"=";var i={};if("string"!=typeof e||0===e.length)return i;var o=/\+/g;e=e.split

100// Copyright Joyent, Inc. and other Node contributors.

101"use strict";var f=function(e){switch(typeof e){case"string":return e;case"boolean":return e?"true":"false";case"number":return isFinite(e)?e:"";default:return""}};m.exports=function(n,r,

102// Copyright Joyent, Inc. and other Node contributors.

104// Copyright Joyent, Inc. and other Node contributors.

106// Copyright Joyent, Inc. and other Node contributors.

108// Copyright Joyent, Inc. and other Node contributors.

109"use strict";_.exports=p;var f=E("./_stream_duplex"),d=E("core-util-is");function p(e){if(!(this instanceof p))return new p(e);f.call(this,e),this._transformState={afterTransform:function(

110// Copyright Joyent, Inc. and other Node contributors.

111"use strict";var g=C("process-nextick-args");function f(e){var t=this;this.next=null,this.entry=null,this.finish=function(){!function(e,t,n){var r=e.entry;e.entry=null;

112// Copyright Joyent, Inc. and other Node contributors.

114// Copyright Joyent, Inc. and other Node contributors.

115"use strict";var L=h("punycode"),R=h("./util");function N(){this.protocol=null,this.slashes=null,this.auth=null,this.host=null,this.port=null,this.hostname=null,

Long lines were clipped for display.

README.mdView file

Lines 48-88markdown

482. Import the library:

49 ```javascript

50 var Streamer = require("<path to the library>");

51 ```

533. The library is ready for use in your `Node.js` project.

55## Quick Start

57```javascript