@themoltnet/pi-extension@0.33.0: Suspicious npm security report

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 957 KB of source, external domains: api.themolt.net, example.com, github.com, registry.npmjs.org, tools.ietf.org, www.rfc-editor.org

Source & flagged code

2 flagged

dist/index.jsView file

1import { createRequire } from "node:module"; L2: import { execFileSync } from "node:child_process"; L3: import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs"; ... L70: ...options, L71: body: options.serializedBody, L72: headers, ... L79: if (!response.body) throw new Error("No body in SSE response"); L80: const reader = response.body.pipeThrough(new TextDecoderStream()).getReader(); L81: let buffer = ""; ... L520: try { L521: response = await _fetch(request); L522: } catch (error) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js L1: import { createRequire } from "node:module"; L2: import { execFileSync } from "node:child_process"; L3: import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs"; ... L70: ...options, L71: body: options.serializedBody, L72: headers, ... L79: if (!response.body) throw new Error("No body in SSE response"); L80: const reader = response.body.pipeThrough(new TextDecoderStream()).getReader(); L81: let buffer = ""; ... L520: try { L521: response = await _fetch(request); L522: } catch (error) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

dist/index.jsView file

1import { createRequire } from "node:module"; L2: import { execFileSync } from "node:child_process"; L3: import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs"; ... L70: ...options, L71: body: options.serializedBody, L72: headers, ... L79: if (!response.body) throw new Error("No body in SSE response"); L80: const reader = response.body.pipeThrough(new TextDecoderStream()).getReader(); L81: let buffer = ""; ... L520: try { L521: response = await _fetch(request); L522: } catch (error) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js L1: import { createRequire } from "node:module"; L2: import { execFileSync } from "node:child_process"; L3: import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs"; ... L70: ...options, L71: body: options.serializedBody, L72: headers, ... L79: if (!response.body) throw new Error("No body in SSE response"); L80: const reader = response.body.pipeThrough(new TextDecoderStream()).getReader(); L81: let buffer = ""; ... L520: try { L521: response = await _fetch(request); L522: } catch (error) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

Findings

2 Critical3 Medium4 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings