Static Scan Results
scanned 4d ago · by rust-scannerStatic analysis flagged 17 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcedist/bootstrap.jsView file
21import { join } from "path";
L22: import { execFileSync, execSync } from "child_process";
L23: function which(cmd2) {
...
L41: const agents = [];
L42: const home = homedir();
L43: const claudeBinary = which("claude");
...
L56: const cursorConfigDir = join(home, ".cursor");
L57: const cursorApp = process.platform === "darwin" && existsSync("/Applications/Cursor.app");
L58: if (cursorBinary || cursorApp || existsSync(cursorConfigDir)) {
...
L92: const raw = readFileSync(path, "utf-8");
L93: return JSON.parse(raw);
L94: } catch (err) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/bootstrap.jsView on unpkg · L2121Trigger-reachable chain: manifest.bin -> dist/bootstrap.js
L21: import { join } from "path";
L22: import { execFileSync, execSync } from "child_process";
L23: function which(cmd2) {
...
L41: const agents = [];
L42: const home = homedir();
L43: const claudeBinary = which("claude");
...
L56: const cursorConfigDir = join(home, ".cursor");
L57: const cursorApp = process.platform === "darwin" && existsSync("/Applications/Cursor.app");
L58: if (cursorBinary || cursorApp || existsSync(cursorConfigDir)) {
...
L92: const raw = readFileSync(path, "utf-8");
L93: return JSON.parse(raw);
L94: } catch (err) {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bootstrap.jsView on unpkg · L2121import { join } from "path";
L22: import { execFileSync, execSync } from "child_process";
L23: function which(cmd2) {
High
1000const heredocRe = /<<-?\\s*['"]?(\\w+)['"]?\\s*\\n([\\s\\S]*?)\\n\\1\\b/g;
L1001: let hm: RegExpExecArray | null;
L1002: while ((hm = heredocRe.exec(command)) !== null) {
High
8360SYNKRO_SHA: \${{ inputs.sha || github.event.pull_request.head.sha }}
L8361: SYNKRO_GATEWAY_URL: \${{ vars.SYNKRO_GATEWAY_URL || 'https://api.synkro.sh' }}
L8362: `;
...
L8368: import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
L8369: import { execSync as execSync2 } from "child_process";
L8370: import { join as join4 } from "path";
...
L8373: input: value,
L8374: env: { ...process.env, GH_TOKEN: token },
L8375: stdio: ["pipe", "ignore", "pipe"],
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bootstrap.jsView on unpkg · L836021import { join } from "path";
L22: import { execFileSync, execSync } from "child_process";
L23: function which(cmd2) {
...
L41: const agents = [];
L42: const home = homedir();
L43: const claudeBinary = which("claude");
...
L56: const cursorConfigDir = join(home, ".cursor");
L57: const cursorApp = process.platform === "darwin" && existsSync("/Applications/Cursor.app");
L58: if (cursorBinary || cursorApp || existsSync(cursorConfigDir)) {
...
L92: const raw = readFileSync(path, "utf-8");
L93: return JSON.parse(raw);
L94: } catch (err) {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/bootstrap.jsView on unpkg · L2121import { join } from "path";
L22: import { execFileSync, execSync } from "child_process";
L23: function which(cmd2) {
...
L91: try {
L92: const raw = readFileSync(path, "utf-8");
L93: return JSON.parse(raw);
...
L8263: // cli/api/projects.ts
L8264: function setApiBaseUrl(url) {
L8265: API_URL = url;
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/bootstrap.jsView on unpkg · L211126try {
L1127: const stat = require('node:fs').statSync(lockfile);
L1128: return Date.now() - stat.mtimeMs > maxAgeMs;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/bootstrap.jsView on unpkg · L112621import { join } from "path";
L22: import { execFileSync, execSync } from "child_process";
L23: function which(cmd2) {
...
L41: const agents = [];
L42: const home = homedir();
L43: const claudeBinary = which("claude");
...
L56: const cursorConfigDir = join(home, ".cursor");
L57: const cursorApp = process.platform === "darwin" && existsSync("/Applications/Cursor.app");
L58: if (cursorBinary || cursorApp || existsSync(cursorConfigDir)) {
...
L92: const raw = readFileSync(path, "utf-8");
L93: return JSON.parse(raw);
L94: } catch (err) {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/bootstrap.jsView on unpkg · L21Findings
2 Critical5 High5 Medium5 Low
CriticalCredential Exfiltrationdist/bootstrap.js
CriticalTrigger Reachable Dangerous Capabilitydist/bootstrap.js
HighChild Processdist/bootstrap.js
HighShelldist/bootstrap.js
HighSame File Env Network Executiondist/bootstrap.js
HighSandbox Evasion Gated Capabilitydist/bootstrap.js
HighRemote Agent Bridgedist/bootstrap.js
MediumDynamic Requiredist/bootstrap.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/bootstrap.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings