registry / @unclesaliva/java-ai-debugger / 1.0.2

@unclesaliva/java-ai-debugger@1.0.2

Java AI Debugger — MCP server (TypeScript) for remote JVM debugging via JDWP

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 49.3 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged

dist/stop.jsView file

Lines 23-63javascript

23 o["default"] = v;

24});

25var __importStar = (this && this.__importStar) || (function () {

26 var ownKeys = function(o) {

27 ownKeys = Object.getOwnPropertyNames || function (o) {

28 var ar = [];

29 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

30 return ar;

31 };

32 return ownKeys(o);

33 };

34 return function (mod) {

35 if (mod && mod.__esModule) return mod;

36 var result = {};

37 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

38 __setModuleDefault(result, mod);

39 return result;

40 };

41})();

42Object.defineProperty(exports, "__esModule", { value: true });

43exports.stopCommand = stopCommand;

44const node_child_process_1 = require("node:child_process");

45const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

46/**

47 * 按命令行关键字查找并终止进程，返回是否杀到了进程。

48 * - win32: PowerShell Get-CimInstance Win32_Process（wmic 在 Win11 已移除）。

49 * - 其他平台: pkill -f。

50 */

51function killByPattern(pattern) {

52 if (os.platform() === "win32") {

53 const ps = `Get-CimInstance Win32_Process | ` +

54 `Where-Object { $_.CommandLine -and $_.CommandLine -like '*${pattern}*' } | ` +

55 `ForEach-Object { $_.ProcessId }`;

56 let out = "";

57 try {

58 out = (0, node_child_process_1.execSync)(`powershell -NoProfile -NonInteractive -Command "${ps}"`, {

59 encoding: "utf-8",

60 stdio: ["pipe", "pipe", "ignore"],

61 });

62 }

63 catch {

dist/autostart.jsView file

Lines 26-66javascript

26});

27var __importStar = (this && this.__importStar) || (function () {

28 var ownKeys = function(o) {

29 ownKeys = Object.getOwnPropertyNames || function (o

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 20923148 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 20923148 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 20923148 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

Source & flagged code

6 flagged · loading source

dist/stop.jsView file

43exports.stopCommand = stopCommand; L44: const node_child_process_1 = require("node:child_process"); L45: const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

dist/autostart.jsView file

46exports.startDebugCore = startDebugCore; L47: const node_child_process_1 = require("node:child_process"); L48: const fs = __importStar(require("node:fs")); ... L50: const os = __importStar(require("node:os")); L51: const net = __importStar(require("node:net")); L52: let debugCoreProc = null; ... L54: function resolveJava() { L55: const envHome = process.env.JAVA_HOME; L56: const candidates = [];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/autostart.jsView on unpkg · L46

•matchType = previous_version_dangerous_delta matchedPackage = @unclesaliva/java-ai-debugger@1.0.1 matchedIdentity = npm:[redacted]:1.0.1 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/autostart.jsView on unpkg

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 20923148 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 20923148 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 20923148 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

Findings

4 High4 Medium6 Low

HighChild Processdist/stop.js

HighSame File Env Network Executiondist/autostart.js

HighShips High Entropy Bloblib/debug-core-0.2.0-SNAPSHOT.jar

HighPrevious Version Dangerous Deltadist/autostart.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Bloblib/debug-core-0.2.0-SNAPSHOT.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionlib/debug-core-0.2.0-SNAPSHOT.jar

Source & flagged code

6 flagged

dist/stop.jsView file

Lines 23-63javascript

23 o["default"] = v;

24});

25var __importStar = (this && this.__importStar) || (function () {

26 var ownKeys = function(o) {

27 ownKeys = Object.getOwnPropertyNames || function (o) {

28 var ar = [];

29 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

30 return ar;

31 };

32 return ownKeys(o);

33 };

34 return function (mod) {

35 if (mod && mod.__esModule) return mod;

36 var result = {};

37 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

38 __setModuleDefault(result, mod);

39 return result;

40 };

41})();

42Object.defineProperty(exports, "__esModule", { value: true });

43exports.stopCommand = stopCommand;

44const node_child_process_1 = require("node:child_process");

45const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

46/**

47 * 按命令行关键字查找并终止进程，返回是否杀到了进程。

48 * - win32: PowerShell Get-CimInstance Win32_Process（wmic 在 Win11 已移除）。

49 * - 其他平台: pkill -f。

50 */

51function killByPattern(pattern) {

52 if (os.platform() === "win32") {

53 const ps = `Get-CimInstance Win32_Process | ` +

54 `Where-Object { $_.CommandLine -and $_.CommandLine -like '*${pattern}*' } | ` +

55 `ForEach-Object { $_.ProcessId }`;

56 let out = "";

57 try {

58 out = (0, node_child_process_1.execSync)(`powershell -NoProfile -NonInteractive -Command "${ps}"`, {

59 encoding: "utf-8",

60 stdio: ["pipe", "pipe", "ignore"],

61 });

62 }

63 catch {

dist/autostart.jsView file

Lines 26-66javascript

26});

27var __importStar = (this && this.__importStar) || (function () {

28 var ownKeys = function(o) {

29 ownKeys = Object.getOwnPropertyNames || function (o

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 20923148 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 20923148 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 20923148 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg