registry  /  @thenewlabs/locus-server  /  0.2.2

@thenewlabs/locus-server@0.2.2

One-command self-contained Locus server: hosted workbench SPA + preview origin + entangle blind relay on a single port

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 7 file(s), 3.42 MB of source, external domains: example.com, git.new, github.com, locus.example.com, react.dev, www.w3.org

Source & flagged code

6 flagged · loading source
dist/relay.jsView file
28503import { EventEmitter } from "node:events"; L28504: import childProcess from "node:child_process"; L28505: import path from "node:path";
High
Child Process

Package source references child process execution.

dist/relay.jsView on unpkg · L28503
30318} L30319: const execArgv = process2.execArgv ?? []; L30320: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Shell

Package source references shell execution.

dist/relay.jsView on unpkg · L30318
180Cross-file remote execution chain: dist/relay.js spawns dist/entangle-client.js; helper contains network access plus dynamic code execution. L180: for (let i = 0; i < namespace.length; i++) { L181: hash = (hash << 5) - hash + namespace.charCodeAt(i); L182: hash |= 0; ... L439: let m; L440: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L441: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L484: if (!r && typeof process !== "undefined" && "env" in process) { L485: r = process.env.DEBUG; L486: } ... L570: } L571: if (process.platform === "win32") { L572: const osRelease = os.release().split(".");
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/relay.jsView on unpkg · L180
2import { createRequire as __lsCreateRequire } from 'module'; L3: const require = __lsCreateRequire(import.meta.url); L4: var __create = Object.create;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/relay.jsView on unpkg · L2
1026site.name = fn.name; L1027: var deprecatedfn = new Function( L1028: "fn",
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/relay.jsView on unpkg · L1026
180for (let i = 0; i < namespace.length; i++) { L181: hash = (hash << 5) - hash + namespace.charCodeAt(i); L182: hash |= 0; ... L439: let m; L440: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L441: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L484: if (!r && typeof process !== "undefined" && "env" in process) { L485: r = process.env.DEBUG; L486: } ... L570: } L571: if (process.platform === "win32") { L572: const osRelease = os.release().split(".");
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/relay.jsView on unpkg · L180

Findings

3 High4 Medium8 Low
HighChild Processdist/relay.js
HighShelldist/relay.js
HighCross File Remote Execution Contextdist/relay.js
MediumDynamic Requiredist/relay.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/relay.js
LowWeak Cryptodist/relay.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings