registry / @ts-analytics/tracking / 0.1.7

@ts-analytics/tracking@0.1.7

A privacy-first analytics toolkit for web applications.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 127 file(s), 1.36 MB of source, external domains: accounts.google.com, analyticsdata.googleapis.com, api.example.com, api.github.com, facebook.com, github.com, google.com, ip-api.com, ipapi.co, linkedin.com, oauth2.googleapis.com, openidconnect.googleapis.com, twitter.com, www.googleapis.com

Source & flagged code

1 flagged

dist/index.jsView file

Lines 1476-1516javascript

1476 }));

1477 }

1478 static processTopReferrers(referrerStats, totalVisitors) {

1479 return referrerStats.sort((a, b) => b.visitors - a.visitors).map((r) => ({

1480 name: r.source,

1481 value: r.visitors,

1482 percentage: totalVisitors > 0 ? r.visitors / totalVisitors * 100 : 0

1483 }));

1484 }

1485 static processTopCountries(geoStats, totalVisitors) {

1486 return geoStats.filter((g) => !g.region).sort((a, b) => b.visitors - a.visitors).map((g) => ({

1487 name: g.country,

1488 value: g.visitors,

1489 percentage: totalVisitors > 0 ? g.visitors / totalVisitors * 100 : 0

1490 }));

1491 }

1492 static processTopRegions(geoStats, totalVisitors) {

1493 return geoStats.filter((g) => g.region && !g.city).sort((a, b) => b.visitors - a.visitors).map((g) => ({

1494 name: g.region,

1495 value: g.visitors,

1496 percentage: totalVisitors > 0 ? g.visitors / totalVisitors * 100 : 0,

1497 metadata: { country: g.country }

1498 }));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1496

1499 }

1500 static processTopCities(geoStats, totalVisitors) {

1501 return geoStats.filter((g) => g.city).sort((a, b) => b.visitors - a.visitors).map((g) => ({

1502 name: g.city,

1503 value: g.visitors,

1504 percentage: totalVisitors > 0 ? g.visitors / totalVisitors * 100 : 0,

1505 metadata: { country: g.country, region: g.region }

1506 }));

1507 }

1508 static processTopDevices(deviceStats, dimension, totalVisitors) {

1509 return deviceStats.filter((d) => d.dimension === dimension).sort((a, b) => b.visitors - a.visitors).map((d) => ({

1510 name: d.value,

1511 value: d.visitors,

1512 percentage: totalVisitors > 0 ? d.visitors / totalVisitors * 100 : 0

1513 }));

1514 }

1515 static processRealtimeData(realtimeStats) {

1516 const uniqueVisitorIds = new Set;

Source & flagged code

1 flagged · loading source

dist/index.jsView file

1496percentage: totalVisitors > 0 ? g.visitors / totalVisitors * 100 : 0, L1497: metadata: { country: g.country } L1498: })); ... L1867: // country and discards it \u2014 no IP geolocation, no third parties. L1868: var tzn='';try{tzn=Intl.DateTimeFormat().resolvedOptions().timeZone||''} L1869: catch (e){} ... L1878: if(b&&n.sendBeacon){try{if(n.sendBeacon(api+'${endpoint}',body))return;}catch(_e){}} L1879: var x=new XMLHttpRequest(); L1880: x.open('POST',api+'${endpoint}',true); ... L1963: const { Reader } = await import("maxmind"); L1964: const dbPath = databasePath || process.env.MAXMIND_DB_PATH || "./GeoLite2-City.mmdb"; L1965: const reader = await Reader.open(dbPath);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1496

Findings

1 High3 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 1476-1516javascript

1476 }));

1477 }

1478 static processTopReferrers(referrerStats, totalVisitors) {

1479 return referrerStats.sort((a, b) => b.visitors - a.visitors).map((r) => ({

1480 name: r.source,

1481 value: r.visitors,

1482 percentage: totalVisitors > 0 ? r.visitors / totalVisitors * 100 : 0

1483 }));

1484 }

1485 static processTopCountries(geoStats, totalVisitors) {

1486 return geoStats.filter((g) => !g.region).sort((a, b) => b.visitors - a.visitors).map((g) => ({

1487 name: g.country,

1488 value: g.visitors,

1489 percentage: totalVisitors > 0 ? g.visitors / totalVisitors * 100 : 0

1490 }));

1491 }

1492 static processTopRegions(geoStats, totalVisitors) {

1493 return geoStats.filter((g) => g.region && !g.city).sort((a, b) => b.visitors - a.visitors).map((g) => ({

1494 name: g.region,

1495 value: g.visitors,

1496 percentage: totalVisitors > 0 ? g.visitors / totalVisitors * 100 : 0,

1497 metadata: { country: g.country }

1498 }));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1496

1499 }

1500 static processTopCities(geoStats, totalVisitors) {

1501 return geoStats.filter((g) => g.city).sort((a, b) => b.visitors - a.visitors).map((g) => ({

1502 name: g.city,

1503 value: g.visitors,

1504 percentage: totalVisitors > 0 ? g.visitors / totalVisitors * 100 : 0,

1505 metadata: { country: g.country, region: g.region }

1506 }));

1507 }

1508 static processTopDevices(deviceStats, dimension, totalVisitors) {

1509 return deviceStats.filter((d) => d.dimension === dimension).sort((a, b) => b.visitors - a.visitors).map((d) => ({

1510 name: d.value,

1511 value: d.visitors,

1512 percentage: totalVisitors > 0 ? d.visitors / totalVisitors * 100 : 0

1513 }));

1514 }

1515 static processRealtimeData(realtimeStats) {

1516 const uniqueVisitorIds = new Set;