registry / @serifpersia/dango / 2.6.9

@serifpersia/dango@2.6.9

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 83 file(s), 1.20 MB of source, external domains: accounts.google.com, admin.hentaini.com, aln.youtube-anime.com, ani10.nukitashi.top, anidb.app, anilight.live, anilist.co, animepahe.pw, animeya.cc, api.anilight.live, api.aniskip.com, api.github.com, api.themoviedb.org, api.wecollege.net, cdn.jsdelivr.net, clients5.google.com, discord.com, discord.gg, embedmaster.link, fb.me, github.com, gogoanime.lu, graphql.anilist.co, hentai.tv, hentaini.com, image.tmdb.org, japaneseasmr.com, kitsu.app, megaplay.buzz, myspacecat.pictures, nhplayer.com, oauth2.googleapis.com, oppai.stream, player.videasy.to, raw.githubusercontent.com, registry.npmjs.org, s4.anilist.co, script.google.com, shirayuki-scrapper-api.onrender.com, v3.sg.media-imdb.com, vidfast.pro, vidrock.ru, vixsrc.to, watchhentai.net, www.dlsite.com, www.googleapis.com, www.movy.bz, www.mp4upload.com, www.w3.org

Source & flagged code

5 flagged

server/.envView file

1patternName = blocked_file severity = critical blockedFile = server/.env redactedSecretContext = secretLikeLines = 1 L1: DISCORD_CLIENT_ID=<redacted:19 hex>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/.envView on unpkg · L1

server/dist/github-sync.jsView file

39exports.githubSyncService = void 0; L40: const logger_1 = __importDefault(require("./logger")); L41: const db_utils_1 = require("./utils/db-utils");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/github-sync.jsView on unpkg · L39

62]; L63: const nativeImport = new Function('specifier', 'return import(specifier)'); L64: function getGitHubClientId() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

server/dist/github-sync.jsView on unpkg · L62

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

server/dist/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @serifpersia/dango@2.6.8 matchedIdentity = npm:QHNlcmlmcGVyc2lhL2Rhbmdv:2.6.8 similarity = 0.805 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/server.jsView on unpkg

Source & flagged code

5 flagged · loading source

server/.envView file

1patternName = blocked_file severity = critical blockedFile = server/.env redactedSecretContext = secretLikeLines = 1 L1: DISCORD_CLIENT_ID=<redacted:19 hex>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/.envView on unpkg · L1

server/dist/github-sync.jsView file

39exports.githubSyncService = void 0; L40: const logger_1 = __importDefault(require("./logger")); L41: const db_utils_1 = require("./utils/db-utils");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/github-sync.jsView on unpkg · L39

62]; L63: const nativeImport = new Function('specifier', 'return import(specifier)'); L64: function getGitHubClientId() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

server/dist/github-sync.js

Findings

1 Critical2 High4 Medium7 Low

CriticalCritical Secretserver/.env

HighSemantic Analysis Limitedpackage.json

HighPrevious Version Dangerous Deltaserver/dist/server.js

MediumDynamic Requireserver/dist/github-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalserver/dist/github-sync.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @serifpersia/dango@2.6.9.

See all versions of @serifpersia/dango for other recorded verdicts.

Review the evidence and your use of @serifpersia/dango@2.6.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-30 19:40:03.989Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.