registry / @serifpersia/dango / 3.1.2
@serifpersia/dango@3.1.2
⚠ Under reviewStatic Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Oversized source lightweight scan
client/dist/assets/index-BOKlZEHq.js3.25 MB file, sampled 256 KB
Source & flagged code
3 flagged · loading sourceserver/dist/github-sync.jsView file
24];
L25: const nativeImport = new Function('specifier', 'return import(specifier)');
L26: function getGitHubClientId() {
Low
Eval
Package source references a known benign dynamic code generation pattern.
server/dist/github-sync.jsView on unpkg · L24client/dist/assets/vendor-core-8R2fFbyN.jsView file
1var pe,g,Xt,X,Et,Zt,Qt,Ie,be,fe,en,Ye,Be,Ve,tn,xe={},Pe=[],Zn=/acit|ex(?:s|g|n|p|$)|rph|grid|ows|mnc|ntw|ine[ch]|zoo|^ord|itera/i,me=Array.isArray;function M(e,t){for(var n in t)e[...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client/dist/assets/vendor-core-8R2fFbyN.jsView on unpkg · L1package.jsonView file
Findings
1 High4 Medium7 Low
HighSemantic Analysis Limitedpackage.json
MediumDynamic Requireclient/dist/assets/vendor-core-8R2fFbyN.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalserver/dist/github-sync.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @serifpersia/dango@3.1.2.
See all versions of @serifpersia/dango for other recorded verdicts.
- Review the evidence and your use of @serifpersia/dango@3.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.