registry  /  @quukk/opencode-clawmessenger  /  1.6.2

@quukk/opencode-clawmessenger@1.6.2

OpenCode ClawMessenger - 虾说桥接插件

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 35 file(s), 557 KB of source, external domains: 127.0.0.1, api.qrserver.com

Source & flagged code

3 flagged · loading source
dist/core/logger.jsView file
1const a0_0x2c8ff7=a0_0xf863;(function(_0x15eea5,_0x20c14e){const _0x28ac63=a0_0xf863,_0x58bfaf=_0x15eea5();while(!![]){try{const _0x37b029=parseInt(_0x28ac63(0x1af))/0x1+parseInt(_...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/core/logger.jsView on unpkg · L1
dist/core/types.jsView file
1function a0_0x30fa(_0x2d6d62,_0x4d40fd){_0x2d6d62=_0x2d6d62-0x1e3;var _0x543ae5=a0_0x543a();var _0x30fa13=_0x543ae5[_0x2d6d62];if(a0_0x30fa['nGvpSM']===undefined){var _0x47dec9=fun...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/core/types.jsView on unpkg · L1
bin/opencode-clawmessenger.cmdView file
•path = bin/opencode-clawmessenger.cmd kind = build_helper sizeBytes = 167 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/opencode-clawmessenger.cmdView on unpkg

Findings

2 High5 Medium5 Low
HighObfuscated Payload Loaderdist/core/types.js
HighObfuscated
MediumDynamic Requiredist/core/logger.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/opencode-clawmessenger.cmd
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings