Static Scan Results
scanned 3h ago · by rust-scannerStatic analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcebin/shumai-transcode-app.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @shumai-one/shumai-transcode@0.1.6
matchedIdentity = npm:[redacted]:0.1.6
similarity = 1.000
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/shumai-transcode-app.jsView on unpkg1466`),fU=(W)=>{let m=UU(W);if(!m.startsWith("---"))return{yamlString:null,body:m};let w=m.indexOf(`
L1467: ---`,3);if(w===-1)return{yamlString:null,body:m};return{yamlString:m.slice(4,w),body:m.slice(w+4).trim()}},mJ=(W)=>{let{yamlString:m,body:w}=fU(W);if(!m)return{frontmatter:{},body:...
L1468: `)}</svg>`}var p2=new TJ;import nJ from"path";function KJ(W){let m=W.replace(/[\x00-\x1f\x7f/\\]/g,"_");if(m=m.replace(/^[\s.]+|[\s.]+$/g,""),m=m.replace(/_+/g,"_"),!m)return"file"...
High
Child Process
Package source references child process execution.
bin/shumai-transcode-app.jsView on unpkg · L14661466`),fU=(W)=>{let m=UU(W);if(!m.startsWith("---"))return{yamlString:null,body:m};let w=m.indexOf(`
L1467: ---`,3);if(w===-1)return{yamlString:null,body:m};return{yamlString:m.slice(4,w),body:m.slice(w+4).trim()}},mJ=(W)=>{let{yamlString:m,body:w}=fU(W);if(!m)return{frontmatter:{},body:...
L1468: `)}</svg>`}var p2=new TJ;import nJ from"path";function KJ(W){let m=W.replace(/[\x00-\x1f\x7f/\\]/g,"_");if(m=m.replace(/^[\s.]+|[\s.]+$/g,""),m=m.replace(/_+/g,"_"),!m)return"file"...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/shumai-transcode-app.jsView on unpkg · L14661465`).replace(/\r/g,`
L1466: `),fU=(W)=>{let m=UU(W);if(!m.startsWith("---"))return{yamlString:null,body:m};let w=m.indexOf(`
L1467: ---`,3);if(w===-1)return{yamlString:null,body:m};return{yamlString:m.slice(4,w),body:m.slice(w+4).trim()}},mJ=(W)=>{let{yamlString:m,body:w}=fU(W);if(!m)return{frontmatter:{},body:...
L1468: `)}</svg>`}var p2=new TJ;import nJ from"path";function KJ(W){let m=W.replace(/[\x00-\x1f\x7f/\\]/g,"_");if(m=m.replace(/^[\s.]+|[\s.]+$/g,""),m=m.replace(/_+/g,"_"),!m)return"file"...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/shumai-transcode-app.jsView on unpkg · L1465941patternName = generic_password
severity = medium
line = 941
matchedText = `,runtim...Raw`
Medium
Secret Pattern
Package contains a possible secret pattern.
bin/shumai-transcode-app.jsView on unpkg · L9411// @bun
L2: import"./chunk-xg9xscqz.js";import{a as U$,b as aG}from"./chunk-nr15akde.js";import{A as q1,B as h6,C as C1,D as j1,E as A1,F as og,d as j2,e as w1,f as PW,g as Y4,h as d5,i as V$,...
L3: `);let g;while((g=CJ.exec(w))!=null){let u=g[1],G=g[2]||"";G=G.trim();let T=G[0];if(G=G.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),T==='"')G=G.replace(/\\n/g,`
L4: `),G=G.replace(/\\r/g,"\r");m[u]=G}return m}function EJ(W){W=W||{};let m=Nu(W);W.path=m;let w=_1.configDotenv(W);if(!w.parsed){let T=Error(`MISSING_DATA: Cannot parse ${m} for an u...
L5: `)}}_2.defaultYaml={explicit:!1,version:"1.2"};_2.defaultTags={"!!":"tag:yaml.org,2002:"};KB.Directives=_2});var tm=s((XB)=>{var mQ=v0(),QB=_6();function RB(W){if(/[\x00-\x19\s,[\]...
...
L1032:
L1033: `)+";"}return{toBeCreated:K,toBeAdded:$,runMigrations:F,compileMigrations:X}}function Mw(W){if(W==="-"||W==="^"||W==="$"||W==="+"||W==="."||W==="("||W===")"||W==="|"||W==="["||W===...
L1034: <html>
...
L1419: 3. Ensure plugins use different HTTP methods for the same path
L1420: `)}}function kg(W,m){let w=m.plugins?.reduce((u,G)=>{return{...u,...G.endpoints}},{})??{},g=m.plugins?.map((u)=>u.middlewares?.map((G)=>{let T=async(n)=>{let K=await
Low
Weak Crypto
Package source references weak cryptographic algorithms.
bin/shumai-transcode-app.jsView on unpkg · L1Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/shumai-transcode-app.js
HighChild Processbin/shumai-transcode-app.js
HighShell
HighSame File Env Network Executionbin/shumai-transcode-app.js
HighCommand Output Exfiltrationbin/shumai-transcode-app.js
MediumSecret Patternbin/shumai-transcode-app.js
MediumNetwork
MediumEnvironment Vars
LowWeak Cryptobin/shumai-transcode-app.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License