@s3p/cli@0.1.1: Suspicious npm security report (Warn)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 773 KB of source, external domains: 169.254.170.2, a.co, aws.amazon.com, cloudfront-fips.cn-northwest-1.amazonaws.com.cn, cloudfront-fips.global.api.aws, cloudfront.amazonaws.com, cloudfront.cn-northwest-1.amazonaws.com.cn, cloudfront.global.api.aws, cognito-identity-fips.us-east-1.amazonaws.com, cognito-identity-fips.us-east-2.amazonaws.com, cognito-identity-fips.us-west-1.amazonaws.com, cognito-identity-fips.us-west-2.amazonaws.com, cognito-identity.amazonaws.com, cognito-idp-fips.us-east-1.amazonaws.com, cognito-idp-fips.us-east-2.amazonaws.com, cognito-idp-fips.us-west-1.amazonaws.com, cognito-idp-fips.us-west-2.amazonaws.com, cognito-idp.amazonaws.com, github.com, iam-fips.global.api.aws, iam-fips.us-iso-east-1.c2s.ic.gov, iam-fips.us-isob-east-1.sc2s.sgov.gov, iam.amazonaws.com, iam.cn-north-1.amazonaws.com.cn, iam.eu-isoe-west-1.cloud.adc-e.uk, iam.eusc-de-east-1.amazonaws.eu, iam.global.api.amazonwebservices.com.cn, iam.global.api.aws, iam.us-gov.amazonaws.com, iam.us-gov.api.aws, iam.us-iso-east-1.c2s.ic.gov, iam.us-isob-east-1.sc2s.sgov.gov, iam.us-isof-south-1.csp.hci.ic.gov, nodejs.org, portal.sso, portal.sso-fips, react-native.canny.io, s3-fips.dualstack, s3-fips.dualstack.us-east-1, s3-fips.us-east-1, s3.amazonaws.com, s3.dualstack, s3.dualstack.us-east-1, s3p.dev, www.w3.org, yarnpkg.com

Source & flagged code

5 flagged

s3p.mjsView file

55`)||(p["#text"]="#text"in p?p["#text"]+d:d);for(let d of i)d.tag in p?Array.isArray(p[d.tag])?p[d.tag].push(d.value):p[d.tag]=[p[d.tag],d.value]:p[d.tag]=d.value;for(let[d,m]of Obj... L56: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:e});return t}});var VB,KB=g(()=>{"use strict";Ae();OT();jB();pD();VB=(t={... L57:

High

Child Process

Package source references child process execution.

s3p.mjsView on unpkg · L55

40${po(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let o=[];for(let s of e.split("/"))s?.length!==0&&s!=="."&&(s===".."?o.pop():o.push(s));let r=`${e?.startsWith("/")?"/":... L41: `);return this.signString(S,{signingDate:r,signingRegion:u,signingService:i,eventStreamCredentials:c})}async signMessage(e,{signingDate:o=new Date,signingRegion:r,signingService:n,... L42: For more information, please visit: `+qre);let n=t.originalExpiration??t.expiration;return{...t,...n?{originalExpiration:n}:{},expiration:r}}});var UN,kN=g(()=>{"use strict";FN();U... ... L55: `)||(p["#text"]="#text"in p?p["#text"]+d:d);for(let d of i)d.tag in p?Array.isArray(p[d.tag])?p[d.tag].push(d.value):p[d.tag]=[p[d.tag],d.value]:p[d.tag]=d.value;for(let[d,m]of Obj... L56: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:e});return t}});var VB,KB=g(()=>{"use strict";Ae();OT();jB();pD();VB=(t={... L57:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

s3p.mjsView on unpkg · L40

40${po(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let o=[];for(let s of e.split("/"))s?.length!==0&&s!=="."&&(s===".."?o.pop():o.push(s));let r=`${e?.startsWith("/")?"/":... L41: `);return this.signString(S,{signingDate:r,signingRegion:u,signingService:i,eventStreamCredentials:c})}async signMessage(e,{signingDate:o=new Date,signingRegion:r,signingService:n,... L42: For more information, please visit: `+qre);let n=t.originalExpiration??t.expiration;return{...t,...n?{originalExpiration:n}:{},expiration:r}}});var UN,kN=g(()=>{"use strict";FN();U... ... L55: `)||(p["#text"]="#text"in p?p["#text"]+d:d);for(let d of i)d.tag in p?Array.isArray(p[d.tag])?p[d.tag].push(d.value):p[d.tag]=[p[d.tag],d.value]:p[d.tag]=d.value;for(let[d,m]of Obj... L56: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:e});return t}});var VB,KB=g(()=>{"use strict";Ae();OT();jB();pD();VB=(t={... L57:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

s3p.mjsView on unpkg · L40

6const __filename = __s3pFileURLToPath(import.meta.url); L7: const __dirname = __s3pDirname(__filename); L8: var Yee=Object.create;var UP=Object.defineProperty;var Zee=Object.getOwnPropertyDescriptor;var ete=Object.getOwnPropertyNames;var tte=Object.getPrototypeOf,ote=Object.prototype.has... L9: versions published after the first week of January 2027 ... L14: L15: More information can be found at: https://a.co/c895JFp`))}}});function nt(t,e,o){return t.$source||(t.$source={}),t.$source[e]=o,t}var P3=g(()=>{"use strict"});import{Readable as d... L16: `+y}catch{!o.logger||o.logger?.constructor?.name==="NoOpLogger"?console.warn(y):o.logger?.warn?.(y)}typeof m.$responseBodyText<"u"&&m.$response&&(m.$response.body=m.$responseBodyTe... L17: `).slice(0,5).filter(e=>!e.includes("stackTraceWarning")).join(` L18: `),Ste={warn:console.warn}});function Js(t){let e=t.getUTCFullYear(),o=t.getUTCMonth(),r=t.getUTCDay(),n=t.getUTCDate(),s=t.getUTCHours(),i=t.getUTCMinutes(),c=t.getUTCSeconds(),u=... L19: `),c){let C=o(await u);d.enqueue(`${s}:${C}\r ... L48: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:t.logger});let c=new URL(e);p4(c,t.logger);let

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

s3p.mjsView on unpkg · L6

6const __filename = __s3pFileURLToPath(import.meta.url); L7: const __dirname = __s3pDirname(__filename); L8: var Yee=Object.create;var UP=Object.defineProperty;var Zee=Object.getOwnPropertyDescriptor;var ete=Object.getOwnPropertyNames;var tte=Object.getPrototypeOf,ote=Object.prototype.has... L9: versions published after the first week of January 2027 ... L14: L15: More information can be found at: https://a.co/c895JFp`))}}});function nt(t,e,o){return t.$source||(t.$source={}),t.$source[e]=o,t}var P3=g(()=>{"use strict"});import{Readable as d... L16: `+y}catch{!o.logger||o.logger?.constructor?.name==="NoOpLogger"?console.warn(y):o.logger?.warn?.(y)}typeof m.$responseBodyText<"u"&&m.$response&&(m.$response.body=m.$responseBodyTe... L17: `).slice(0,5).filter(e=>!e.includes("stackTraceWarning")).join(` L18: `),Ste={warn:console.warn}});function Js(t){let e=t.getUTCFullYear(),o=t.getUTCMonth(),r=t.getUTCDay(),n=t.getUTCDate(),s=t.getUTCHours(),i=t.getUTCMinutes(),c=t.getUTCSeconds(),u=... L19: `),c){let C=o(await u);d.enqueue(`${s}:${C}\r ... L48: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:t.logger});let c=new URL(e);p4(c,t.logger);let

Low

Weak Crypto

Package source references weak cryptographic algorithms.

s3p.mjsView on unpkg · L6

Source & flagged code

5 flagged · loading source

s3p.mjsView file

55`)||(p["#text"]="#text"in p?p["#text"]+d:d);for(let d of i)d.tag in p?Array.isArray(p[d.tag])?p[d.tag].push(d.value):p[d.tag]=[p[d.tag],d.value]:p[d.tag]=d.value;for(let[d,m]of Obj... L56: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:e});return t}});var VB,KB=g(()=>{"use strict";Ae();OT();jB();pD();VB=(t={... L57:

High

Child Process

Package source references child process execution.

s3p.mjsView on unpkg · L55

40${po(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let o=[];for(let s of e.split("/"))s?.length!==0&&s!=="."&&(s===".."?o.pop():o.push(s));let r=`${e?.startsWith("/")?"/":... L41: `);return this.signString(S,{signingDate:r,signingRegion:u,signingService:i,eventStreamCredentials:c})}async signMessage(e,{signingDate:o=new Date,signingRegion:r,signingService:n,... L42: For more information, please visit: `+qre);let n=t.originalExpiration??t.expiration;return{...t,...n?{originalExpiration:n}:{},expiration:r}}});var UN,kN=g(()=>{"use strict";FN();U... ... L55: `)||(p["#text"]="#text"in p?p["#text"]+d:d);for(let d of i)d.tag in p?Array.isArray(p[d.tag])?p[d.tag].push(d.value):p[d.tag]=[p[d.tag],d.value]:p[d.tag]=d.value;for(let[d,m]of Obj... L56: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:e});return t}});var VB,KB=g(()=>{"use strict";Ae();OT();jB();pD();VB=(t={... L57:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

s3p.mjsView on unpkg · L40

40${po(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let o=[];for(let s of e.split("/"))s?.length!==0&&s!=="."&&(s===".."?o.pop():o.push(s));let r=`${e?.startsWith("/")?"/":... L41: `);return this.signString(S,{signingDate:r,signingRegion:u,signingService:i,eventStreamCredentials:c})}async signMessage(e,{signingDate:o=new Date,signingRegion:r,signingService:n,... L42: For more information, please visit: `+qre);let n=t.originalExpiration??t.expiration;return{...t,...n?{originalExpiration:n}:{},expiration:r}}});var UN,kN=g(()=>{"use strict";FN();U... ... L55: `)||(p["#text"]="#text"in p?p["#text"]+d:d);for(let d of i)d.tag in p?Array.isArray(p[d.tag])?p[d.tag].push(d.value):p[d.tag]=[p[d.tag],d.value]:p[d.tag]=d.value;for(let[d,m]of Obj... L56: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:e});return t}});var VB,KB=g(()=>{"use strict";Ae();OT();jB();pD();VB=(t={... L57:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

s3p.mjsView on unpkg · L40

6const __filename = __s3pFileURLToPath(import.meta.url); L7: const __dirname = __s3pDirname(__filename); L8: var Yee=Object.create;var UP=Object.defineProperty;var Zee=Object.getOwnPropertyDescriptor;var ete=Object.getOwnPropertyNames;var tte=Object.getPrototypeOf,ote=Object.prototype.has... L9: versions published after the first week of January 2027 ... L14: L15: More information can be found at: https://a.co/c895JFp`))}}});function nt(t,e,o){return t.$source||(t.$source={}),t.$source[e]=o,t}var P3=g(()=>{"use strict"});import{Readable as d... L16: `+y}catch{!o.logger||o.logger?.constructor?.name==="NoOpLogger"?console.warn(y):o.logger?.warn?.(y)}typeof m.$responseBodyText<"u"&&m.$response&&(m.$response.body=m.$responseBodyTe... L17: `).slice(0,5).filter(e=>!e.includes("stackTraceWarning")).join(` L18: `),Ste={warn:console.warn}});function Js(t){let e=t.getUTCFullYear(),o=t.getUTCMonth(),r=t.getUTCDay(),n=t.getUTCDate(),s=t.getUTCHours(),i=t.getUTCMinutes(),c=t.getUTCSeconds(),u=... L19: `),c){let C=o(await u);d.enqueue(`${s}:${C}\r ... L48: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:t.logger});let c=new URL(e);p4(c,t.logger);let

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

s3p.mjsView on unpkg · L6

6const __filename = __s3pFileURLToPath(import.meta.url); L7: const __dirname = __s3pDirname(__filename); L8: var Yee=Object.create;var UP=Object.defineProperty;var Zee=Object.getOwnPropertyDescriptor;var ete=Object.getOwnPropertyNames;var tte=Object.getPrototypeOf,ote=Object.prototype.has... L9: versions published after the first week of January 2027 ... L14: L15: More information can be found at: https://a.co/c895JFp`))}}});function nt(t,e,o){return t.$source||(t.$source={}),t.$source[e]=o,t}var P3=g(()=>{"use strict"});import{Readable as d... L16: `+y}catch{!o.logger||o.logger?.constructor?.name==="NoOpLogger"?console.warn(y):o.logger?.warn?.(y)}typeof m.$responseBodyText<"u"&&m.$response&&(m.$response.body=m.$responseBodyTe... L17: `).slice(0,5).filter(e=>!e.includes("stackTraceWarning")).join(` L18: `),Ste={warn:console.warn}});function Js(t){let e=t.getUTCFullYear(),o=t.getUTCMonth(),r=t.getUTCDay(),n=t.getUTCDate(),s=t.getUTCHours(),i=t.getUTCMinutes(),c=t.getUTCSeconds(),u=... L19: `),c){let C=o(await u);d.enqueue(`${s}:${C}\r ... L48: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:t.logger});let c=new URL(e);p4(c,t.logger);let

Low

Weak Crypto

Package source references weak cryptographic algorithms.

s3p.mjsView on unpkg · L6

Findings

4 High4 Medium5 Low

HighChild Processs3p.mjs

HighSame File Env Network Executions3p.mjs

HighCommand Output Exfiltrations3p.mjs

HighCloud Metadata Accesss3p.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowWeak Cryptos3p.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings