registry / @toon-protocol/connector / 3.34.6

@toon-protocol/connector@3.34.6

Multi-chain ILP connector with EVM, Solana, and Mina settlement

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 152 file(s), 1.10 MB of source, external domains: 127.0.0.1, arb1.arbitrum.io, discovery.example.com, mainnet.base.org, my-vault.vault.azure.net, sepolia-rollup.arbitrum.io, sepolia.base.org

Source & flagged code

2 flagged

dist/btp/btp-message-parser.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.parseBTPMessage = parseBTPMessage;

4exports.serializeBTPMessage = serializeBTPMessage;

5const btp_types_1 = require("./btp-types");

6function parseBTPMessage(buffer) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/btp/btp-message-parser.jsView on unpkg · L4

7 if (buffer.length < 5) {

8 throw new btp_types_1.BTPError('F00', 'BTP message too short (minimum 5 bytes required)');

9 }

10 let offset = 0;

11 const type = buffer.readUInt8(offset);

12 offset += 1;

13 if (!Object.values(btp_types_1.BTPMessageType).includes(type)) {

14 throw new btp_types_1.BTPError('F00', `Invalid BTP message type: ${type}`);

15 }

16 const requestId = buffer.readUInt32BE(offset);

17 offset += 4;

18 let data;

19 if (type === btp_types_1.BTPMessageType.ERROR) {

20 data = parseErrorData(buffer, offset);

21 }

22 else {

23 data = parseMessageData(buffer, offset);

24 }

dist/http/ilp-http-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @toon-protocol/connector@3.34.5 matchedIdentity = npm:[redacted]:3.34.5 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/http/ilp-http-adapter.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/btp/btp-message-parser.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code