registry  /  @thenewlabs/locus-server  /  0.2.1

@thenewlabs/locus-server@0.2.1

One-command self-contained Locus server: hosted workbench SPA + preview origin + entangle blind relay on a single port

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason
No blocking static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 8 file(s), 4.20 MB of source, external domains: example.com, git.new, github.com, locus.example.com, react.dev, www.w3.org

Source & flagged code

2 flagged · loading source
dist/relay.jsView file
1026site.name = fn.name; L1027: var deprecatedfn = new Function( L1028: "fn",
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/relay.jsView on unpkg · L1026
180for (let i = 0; i < namespace.length; i++) { L181: hash = (hash << 5) - hash + namespace.charCodeAt(i); L182: hash |= 0; ... L439: let m; L440: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L441: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L484: if (!r && typeof process !== "undefined" && "env" in process) { L485: r = process.env.DEBUG; L486: } ... L570: } L571: if (process.platform === "win32") { L572: const osRelease = os.release().split(".");
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/relay.jsView on unpkg · L180

Findings

3 Medium8 Low
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/relay.js
LowWeak Cryptodist/relay.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings