registry / @toon-protocol/connector / 3.36.1

@toon-protocol/connector@3.36.1

Multi-chain ILP connector with EVM, Solana, and Mina settlement

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 152 file(s), 1.11 MB of source, external domains: 127.0.0.1, arb1.arbitrum.io, discovery.example.com, mainnet.base.org, my-vault.vault.azure.net, sepolia-rollup.arbitrum.io, sepolia.base.org

Source & flagged code

3 flagged

dist/settlement/mina-payment-channel-sdk.jsView file

Lines 40-80javascript

40 TRANSACTION_FAILED: 1002,

41 PROOF_GENERATION_FAILED: 1003,

42 INVALID_CHANNEL_STATE: 1004,

43 ACCOUNT_NOT_FOUND: 1005,

44 INVALID_PROOF: 1006,

45 ARCHIVE_NODE_ERROR: 1007,

46 INVALID_PARAMETERS: 1008,

47 O1JS_NOT_AVAILABLE: 9999,

48};

49class MinaChannelError extends Error {

50 code;

51 errorName;

52 constructor(message, code, errorName) {

53 super(message);

54 this.name = 'MinaChannelError';

55 this.code = code;

56 this.errorName = errorName;

57 Error.captureStackTrace(this, MinaChannelError);

58 }

59}

60exports.MinaChannelError = MinaChannelError;

61const esmDynamicImport = new Function('specifier', 'return import(specifier);');

62const MINA_ZKAPP_ESM_PAYMENT_CHANNEL = '@toon-protocol/mina-zkapp/dist-esm/PaymentChannel.js';

High

Eval

Package source references dynamic code evaluation.

dist/settlement/mina-payment-channel-sdk.jsView on unpkg · L60

63const MINA_ZKAPP_ESM_USDC_CHANNEL_TOKEN = '@toon-protocol/mina-zkapp/dist-esm/usdc-channel-token.js';

64const IS_JEST = typeof process !== 'undefined' && !!process.env.JEST_WORKER_ID;

65let o1jsModule = null;

66async function getO1js() {

67 if (!o1jsModule) {

68 try {

69 o1jsModule = IS_JEST ? await Promise.resolve().then(() => __importStar(require('o1js'))) : await esmDynamicImport('o1js');

70 }

71 catch {

72 throw new MinaChannelError('o1js is required for Mina payment channels but is not installed. ' +

73 'Install it with: npm install o1js', exports.MINA_ERROR_CODES.O1JS_NOT_AVAILABLE, 'O1JS_NOT_AVAILABLE');

74 }

75 }

76 return o1jsModule;

77}

78let PaymentChannelContract = null;

79async function getPaymentChannelContract() {

80 if (!PaymentChannelContract) {

dist/btp/btp-message-parser.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.parseBTPMessage = parseBTPMessage;

4exports.serializeBTPMessage = serializeBTPMessage;

5const btp_types_1

dist/core/connector-node.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @toon-protocol/connector@3.35.0 matchedIdentity = npm:[redacted]:3.35.0 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/connector-node.jsView on unpkg

Source & flagged code

3 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code