@sentio/sdk-bundle@4.3.2: Suspicious npm security report (Warn)

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 8.15 MB of source, external domains: 127.0.0.1, abelfinance.xyz, amnis.finance, animeswap.org, apetos.xyz, api.apr.dev, api.devnet.solana.com, api.mainnet-beta.solana.com, api.mainnet.iota.cafe, api.sentio.xyz, api.testnet.iota.cafe, api.testnet.solana.com, app.sentio.xyz, app.zion.bet, apt-20.com, aptoast.com, aptoge.com, aptopad.io, aptos.testnet.bardock.movementlabs.xyz, aptosapartments.rent, aptosfoundation.org, aptoslaunch.io, aptosroo.io, aptosx.app, aptothemascot.com, aptpp.com, aptswap.io, argo.fi, ariesmarkets.xyz, assets.coingecko.com, assets.fuel.network, baptmantoken.com, bluemove.net, burritos-aptos.com, cellana.finance, chewytoken.com, citadeli.crypto, cryptototem.com, ddosapt.com, developer.mozilla.org, dex.mojito.markets, docs.sentio.xyz, donkmove.com, doodoo.io, dumdum.cc, edog.baby, eonlabz.com, eternalfinance.io, faptosaptos.com, fullnode.devnet.sui.io

Source & flagged code

3 flagged

dist/solana-5U14L00q.jsView file

1import{a as e,i as t,n,o as r,r as i,s as a}from"./bignumber-S0hpcsj2.js";import{$n as o,An as s,Ct as c,F as l,Nn as u,P as d,Z as f,gt as p,kn as m,o as g,ot as _,st as v,ui as y... L2: `+k(e),l.Internal)});n.push(a)}return A(await Promise.all(n))}async processSolBlock(e){if(e.data?.value.case!==`solBlock`)throw new d(`block data cannot be empty`,l.InvalidArgument... ... L5: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ L6: let t=ne();var n=ne();Object.defineProperty(e,"abytes",{enumerable:!0,get:function(){return n.abytes}}),Object.defineProperty(e,"anumber",{enumerable:!0,get:function(){return n.anu... L7: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ ... L126: */ L127: Object.defineProperty(e,"__esModule",{value:!0}),e.s16=e.s8=e.nu64be=e.u48be=e.u40be=e.u32be=e.u24be=e.u16be=e.nu64=e.u48=e.u40=e.u32=e.u24=e.u16=e.u8=e.offset=e.greedy=e.Constant=... L128: ... L130: L131: For a list of runtimes that currently support Ed25519 operations, visit https://github.com/WICG/webcrypto-secure-curves/issues/20.`,[L]:`No signature verification implementation co... L132: loaded from: `+e+` L133: `);function resolve(e){var t=readdirSync

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/solana-5U14L00q.jsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/solana/index.js -> dist/solana-5U14L00q.js L1: import{a as e,i as t,n,o as r,r as i,s as a}from"./bignumber-S0hpcsj2.js";import{$n as o,An as s,Ct as c,F as l,Nn as u,P as d,Z as f,gt as p,kn as m,o as g,ot as _,st as v,ui as y... L2: `+k(e),l.Internal)});n.push(a)}return A(await Promise.all(n))}async processSolBlock(e){if(e.data?.value.case!==`solBlock`)throw new d(`block data cannot be empty`,l.InvalidArgument... ... L5: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ L6: let t=ne();var n=ne();Object.defineProperty(e,"abytes",{enumerable:!0,get:function(){return n.abytes}}),Object.defineProperty(e,"anumber",{enumerable:!0,get:function(){return n.anu... L7: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ ... L126: */ L127: Object.defineProperty(e,"__esModule",{value:!0}),e.s16=e.s8=e.nu64be=e.u48be=e.u40be=e.u32be=e.u24be=e.u16be=e.nu64=e.u48=e.u40=e.u32=e.u24=e.u16=e.u8=e.offset=e.greedy=e.Constant=... L128: ... L130: L131: For a list of runtimes that currently support Ed25519 operations, visit https://github.com/WICG/webcrypto-secure-curves/issues/20.`,[L]:`No signature verificatio…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/solana-5U14L00q.jsView on unpkg · L1

1import{a as e,i as t,n,o as r,r as i,s as a}from"./bignumber-S0hpcsj2.js";import{$n as o,An as s,Ct as c,F as l,Nn as u,P as d,Z as f,gt as p,kn as m,o as g,ot as _,st as v,ui as y... L2: `+k(e),l.Internal)});n.push(a)}return A(await Promise.all(n))}async processSolBlock(e){if(e.data?.value.case!==`solBlock`)throw new d(`block data cannot be empty`,l.InvalidArgument... ... L5: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ L6: let t=ne();var n=ne();Object.defineProperty(e,"abytes",{enumerable:!0,get:function(){return n.abytes}}),Object.defineProperty(e,"anumber",{enumerable:!0,get:function(){return n.anu... L7: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ ... L126: */ L127: Object.defineProperty(e,"__esModule",{value:!0}),e.s16=e.s8=e.nu64be=e.u48be=e.u40be=e.u32be=e.u24be=e.u16be=e.nu64=e.u48=e.u40=e.u32=e.u24=e.u16=e.u8=e.offset=e.greedy=e.Constant=... L128: ... L130: L131: For a list of runtimes that currently support Ed25519 operations, visit https://github.com/WICG/webcrypto-secure-curves/issues/20.`,[L]:`No signature verification implementation co... L132: loaded from: `+e+` L133: `);function resolve(e){var t=readdirSync

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/solana-5U14L00q.jsView on unpkg · L1

Source & flagged code

3 flagged · loading source

dist/solana-5U14L00q.jsView file

1import{a as e,i as t,n,o as r,r as i,s as a}from"./bignumber-S0hpcsj2.js";import{$n as o,An as s,Ct as c,F as l,Nn as u,P as d,Z as f,gt as p,kn as m,o as g,ot as _,st as v,ui as y... L2: `+k(e),l.Internal)});n.push(a)}return A(await Promise.all(n))}async processSolBlock(e){if(e.data?.value.case!==`solBlock`)throw new d(`block data cannot be empty`,l.InvalidArgument... ... L5: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ L6: let t=ne();var n=ne();Object.defineProperty(e,"abytes",{enumerable:!0,get:function(){return n.abytes}}),Object.defineProperty(e,"anumber",{enumerable:!0,get:function(){return n.anu... L7: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ ... L126: */ L127: Object.defineProperty(e,"__esModule",{value:!0}),e.s16=e.s8=e.nu64be=e.u48be=e.u40be=e.u32be=e.u24be=e.u16be=e.nu64=e.u48=e.u40=e.u32=e.u24=e.u16=e.u8=e.offset=e.greedy=e.Constant=... L128: ... L130: L131: For a list of runtimes that currently support Ed25519 operations, visit https://github.com/WICG/webcrypto-secure-curves/issues/20.`,[L]:`No signature verification implementation co... L132: loaded from: `+e+` L133: `);function resolve(e){var t=readdirSync

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/solana-5U14L00q.jsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/solana/index.js -> dist/solana-5U14L00q.js L1: import{a as e,i as t,n,o as r,r as i,s as a}from"./bignumber-S0hpcsj2.js";import{$n as o,An as s,Ct as c,F as l,Nn as u,P as d,Z as f,gt as p,kn as m,o as g,ot as _,st as v,ui as y... L2: `+k(e),l.Internal)});n.push(a)}return A(await Promise.all(n))}async processSolBlock(e){if(e.data?.value.case!==`solBlock`)throw new d(`block data cannot be empty`,l.InvalidArgument... ... L5: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ L6: let t=ne();var n=ne();Object.defineProperty(e,"abytes",{enumerable:!0,get:function(){return n.abytes}}),Object.defineProperty(e,"anumber",{enumerable:!0,get:function(){return n.anu... L7: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ ... L126: */ L127: Object.defineProperty(e,"__esModule",{value:!0}),e.s16=e.s8=e.nu64be=e.u48be=e.u40be=e.u32be=e.u24be=e.u16be=e.nu64=e.u48=e.u40=e.u32=e.u24=e.u16=e.u8=e.offset=e.greedy=e.Constant=... L128: ... L130: L131: For a list of runtimes that currently support Ed25519 operations, visit https://github.com/WICG/webcrypto-secure-curves/issues/20.`,[L]:`No signature verificatio…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/solana-5U14L00q.jsView on unpkg · L1

1import{a as e,i as t,n,o as r,r as i,s as a}from"./bignumber-S0hpcsj2.js";import{$n as o,An as s,Ct as c,F as l,Nn as u,P as d,Z as f,gt as p,kn as m,o as g,ot as _,st as v,ui as y... L2: `+k(e),l.Internal)});n.push(a)}return A(await Promise.all(n))}async processSolBlock(e){if(e.data?.value.case!==`solBlock`)throw new d(`block data cannot be empty`,l.InvalidArgument... ... L5: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ L6: let t=ne();var n=ne();Object.defineProperty(e,"abytes",{enumerable:!0,get:function(){return n.abytes}}),Object.defineProperty(e,"anumber",{enumerable:!0,get:function(){return n.anu... L7: /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ ... L126: */ L127: Object.defineProperty(e,"__esModule",{value:!0}),e.s16=e.s8=e.nu64be=e.u48be=e.u40be=e.u32be=e.u24be=e.u16be=e.nu64=e.u48=e.u40=e.u32=e.u24=e.u16=e.u8=e.offset=e.greedy=e.Constant=... L128: ... L130: L131: For a list of runtimes that currently support Ed25519 operations, visit https://github.com/WICG/webcrypto-secure-curves/issues/20.`,[L]:`No signature verification implementation co... L132: loaded from: `+e+` L133: `);function resolve(e){var t=readdirSync

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/solana-5U14L00q.jsView on unpkg · L1

Findings

2 Critical5 Medium5 Low

CriticalWallet Draindist/solana-5U14L00q.js

CriticalTrigger Reachable Dangerous Capabilitydist/solana-5U14L00q.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowWeak Cryptodist/solana-5U14L00q.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings