Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourcedist/index.jsView file
34});
L35: import { exec, spawn } from "child_process";
L36: import { mkdir, readFile, writeFile, chmod } from "fs/promises";
...
L42: async function githubRequest(token, method, path, body) {
L43: const response = await fetch(`${API}${path}`, {
L44: method,
...
L51: },
L52: body: body === void 0 ? void 0 : JSON.stringify(body)
L53: });
L54: if (!response.ok) {
L55: const text = await response.text().catch(() => "");
L56: throw new Error(`GitHub API ${method} ${path} failed (${response.status}): ${text}`);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L34105try {
L106: const { readFile: readFile211 } = await import("fs/promises");
L107: const { join: join211 } = await import("path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L105Findings
1 High4 Medium4 Low
HighSandbox Evasion Gated Capabilitydist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings