registry / @runfusion/fusion / 0.72.0

@runfusion/fusion@0.72.0

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 344 file(s), 30.0 MB of source, external domains: 127.0.0.1, api.example.com, api.github.com, api.linear.app, bit.ly, chevrotain.io, discord.gg, docs.openclaw.ai, docs.x.ai, en.wikipedia.org, git-scm.com, github.com, gitlab.com, gitlab.example.com, hooks.example.com, jquery.org, json-schema.org, langium.org, lodash.com, node.example.com, ntfy.sh, omp.sh, openjsf.org, paperclip.ing, pro.reactflow.dev, react.dev, reactflow.dev, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, runfusion.ai, searx.example.com, tldrlegal.com, underscorejs.org, www.w3.org, your-domain.example

Oversized source lightweight scan

dist/bin.js15.9 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsShellDynamicRequire

Source & flagged code

11 flagged

dist/chunk-4L6CLWJC.jsView file

Lines 4215-4255javascript

4215 return { ok: false, reason: "not_found", current: null };

4216 }

4217 if (existing.ownerNodeId !== input.nodeId || existing.ownerAgentId !== input.agentId) {

4218 return { ok: false, reason: "not_owner", current: existing };

4219 }

4220 this.db.prepare("DELETE FROM taskClaims WHERE projectId = ? AND taskId = ?").run(input.projectId, input.taskId);

4221 return { ok: true };

4222 });

4223 } catch (error) {

4224 throw new Error(`Failed to release task claim ${input.projectId}/${input.taskId}: ${error instanceof Error ? error.message : String(error)}`

4225 }

4226 }

4227 /**

4228 * Prepare a SQL statement. Returns a Statement object.

4229 */

4230 prepare(sql) {

4231 return this.db.prepare(sql);

4232 }

4233 /**

4234 * Execute a raw SQL string (no parameters).

4235 */

4236 exec(sql) {

4237 this.db.exec(sql);

High

Child Process

Package source references child process execution.

dist/chunk-4L6CLWJC.jsView on unpkg · L4235

4238 }

4239 /**

4240 * Get the last modification timestamp (epoch ms).

4241 * Returns 0 if the value is not set.

4242 */

4243 getLastModified() {

4244 const row = this.db.prepare("SELECT value FROM __meta WHERE key = 'lastModified'").get();

4245 if (!row)

4246 return 0;

4247 return parseInt(row.value, 10) || 0;

4248 }

4249 /**

4250 * Update the last modification timestamp to the current time.

4251 * Guarantees monotonicity: the new value is always strictly greater than

4252 * the previous value, even if called multiple times within the same millisecond.

4253 * Call this after every write operation to enable change detection polling.

4254 */

4255 bumpLastModified() {

Lines 4975-5015javascript

4975 this.name = "NoMatchError";

4976 Object.setPrototypeOf(this, _NoMatchError.prototype);

4977 }

4978};

4979async function isDirectoryExisting(directoryPath,

dist/chunk-AWKNRUOR.jsView file

Lines 643-683javascript

643

644Output Requirements:

645- Fast-bail: if Diff Scope contains no QA-relevant files, output {"verdict":"APPROVE","notes":"out of scope: QA"} immediately.

646-

bin.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3import { constants } from "node:fs";

4import { access } from "node:fs/promises";

5import { dirname, resolve } from "node:path";

6import { fileURLToPath, pathToFileURL }

dist/chunk-PSDYB45U.jsView file

Lines 8-48javascript

8import { join as join2 } from "path";

10// ../core/dist/memory-backend.js

11import { readFile, writeFile, mkdir, access, constants, readdir, stat } from "fs/promises";

12import { existsSync } from "fs";

dist/plugins/fusion-plugin-compound-engineering/skills/ce-brainstorm/scripts/visual-probe-server.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/* global console, process, setInterval, setTimeout */

3import { execFileSync, spawn } from "node:child_process"

4import fs from "node:fs"

5import http from "node:http"

dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.shView file

•path = dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.sh kind = build_helper sizeBytes = 12403 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.shView on unpkg

dist/bin.jsView file

•path = dist/bin.js kind = oversized_source_file sizeBytes = 16634460 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.jsView on unpkg

•path = dist/bin.js kind = oversized_cli_entrypoint sizeBytes = 16634460 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.jsView on unpkg

dist/client/assets/cytoscape.esm-OyMbaexL.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.26 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/cytoscape.esm-OyMbaexL.jsView on unpkg

dist/desktop/client/assets/cytoscape.esm-OyMbaexL.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/desktop/client/assets/cytoscape.esm-OyMbaexL.jsView on unpkg

Source & flagged code

11 flagged · loading source

dist/chunk-4L6CLWJC.jsView file

4235*/ L4236: exec(sql) { L4237: this.db.exec(sql);

High

Child Process

Package source references child process execution.

dist/chunk-4L6CLWJC.jsView on unpkg · L4235

4995} L4996: async function hasPowerShell3(dependencies) { L4997: const major = parseInt(dependencies.release.split(".")[0], 10);

High

Shell

Package source references shell execution.

dist/chunk-4L6CLWJC.jsView on unpkg · L4995

dist/chunk-AWKNRUOR.jsView file

6632. **Secrets and credentials** \u2014 Ensure no hardcoded passwords, API keys, tokens, or private keys L664: 3. **Unsafe eval** \u2014 Check for eval(), new Function(), or similar dangerous patterns L665: 4. **Path traversal** \u2014 Verify file path handling prevents directory traversal attacks

Low

Eval

Package source references a known benign dynamic code generation pattern.

Findings

7 High7 Medium7 Low

HighChild Processdist/chunk-4L6CLWJC.js

HighShelldist/chunk-4L6CLWJC.js

HighSame File Env Network Executiondist/plugins/fusion-plugin-compound-engineering/skills/ce-brainstorm/scripts/visual-probe-server.js

HighObfuscated

HighOversized Source Filedist/bin.js

HighKnown Malware Source Similaritydist/client/assets/cytoscape.esm-OyMbaexL.js

HighKnown Malware Source Similaritydist/desktop/client/assets/cytoscape.esm-OyMbaexL.js

MediumDynamic Requirebin.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperdist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.sh