registry / @unclesaliva/java-ai-debugger / 1.0.3

@unclesaliva/java-ai-debugger@1.0.3

Java AI Debugger — MCP server (TypeScript) for remote JVM debugging via JDWP

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 51.0 KB of source, external domains: 127.0.0.1

Source & flagged code

5 flagged

dist/stop.jsView file

Lines 23-63javascript

23 o["default"] = v;

24});

25var __importStar = (this && this.__importStar) || (function () {

26 var ownKeys = function(o) {

27 ownKeys = Object.getOwnPropertyNames || function (o) {

28 var ar = [];

29 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

30 return ar;

31 };

32 return ownKeys(o);

33 };

34 return function (mod) {

35 if (mod && mod.__esModule) return mod;

36 var result = {};

37 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

38 __setModuleDefault(result, mod);

39 return result;

40 };

41})();

42Object.defineProperty(exports, "__esModule", { value: true });

43exports.stopCommand = stopCommand;

44const node_child_process_1 = require("node:child_process");

45const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

46/**

47 * 按命令行关键字查找并终止进程，返回是否杀到了进程。

48 * - win32: PowerShell Get-CimInstance Win32_Process（wmic 在 Win11 已移除）。

49 * - 其他平台: pkill -f。

50 */

51function killByPattern(pattern) {

52 if (os.platform() === "win32") {

53 const ps = `Get-CimInstance Win32_Process | ` +

54 `Where-Object { $_.CommandLine -and $_.CommandLine -like '*${pattern}*' } | ` +

55 `ForEach-Object { $_.ProcessId }`;

56 let out = "";

57 try {

58 out = (0, node_child_process_1.execSync)(`powershell -NoProfile -NonInteractive -Command "${ps}"`, {

59 encoding: "utf-8",

60 stdio: ["pipe", "pipe", "ignore"],

61 });

62 }

63 catch {

dist/autostart.jsView file

Lines 26-66javascript

26});

27var __importStar = (this && this.__importStar) || (function () {

28 var ownKeys = function(o) {

29 ownKeys = Object.getOwnPropertyNames || function (o

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 20923136 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 20923136 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 20923136 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

Source & flagged code

5 flagged · loading source

dist/stop.jsView file

43exports.stopCommand = stopCommand; L44: const node_child_process_1 = require("node:child_process"); L45: const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

dist/autostart.jsView file

46exports.startDebugCore = startDebugCore; L47: const node_child_process_1 = require("node:child_process"); L48: const fs = __importStar(require("node:fs")); ... L50: const os = __importStar(require("node:os")); L51: const net = __importStar(require("node:net")); L52: let debugCoreProc = null; ... L54: function resolveJava() { L55: const envHome = process.env.JAVA_HOME; L56: const candidates = [];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/autostart.jsView on unpkg · L46

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 20923136 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 20923136 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 20923136 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

Findings

3 High4 Medium6 Low

HighChild Processdist/stop.js

HighSame File Env Network Executiondist/autostart.js

HighShips High Entropy Bloblib/debug-core-0.2.0-SNAPSHOT.jar

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Bloblib/debug-core-0.2.0-SNAPSHOT.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionlib/debug-core-0.2.0-SNAPSHOT.jar

Source & flagged code

5 flagged

dist/stop.jsView file

Lines 23-63javascript

23 o["default"] = v;

24});

25var __importStar = (this && this.__importStar) || (function () {

26 var ownKeys = function(o) {

27 ownKeys = Object.getOwnPropertyNames || function (o) {

28 var ar = [];

29 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

30 return ar;

31 };

32 return ownKeys(o);

33 };

34 return function (mod) {

35 if (mod && mod.__esModule) return mod;

36 var result = {};

37 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

38 __setModuleDefault(result, mod);

39 return result;

40 };

41})();

42Object.defineProperty(exports, "__esModule", { value: true });

43exports.stopCommand = stopCommand;

44const node_child_process_1 = require("node:child_process");

45const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

46/**

47 * 按命令行关键字查找并终止进程，返回是否杀到了进程。

48 * - win32: PowerShell Get-CimInstance Win32_Process（wmic 在 Win11 已移除）。

49 * - 其他平台: pkill -f。

50 */

51function killByPattern(pattern) {

52 if (os.platform() === "win32") {

53 const ps = `Get-CimInstance Win32_Process | ` +

54 `Where-Object { $_.CommandLine -and $_.CommandLine -like '*${pattern}*' } | ` +

55 `ForEach-Object { $_.ProcessId }`;

56 let out = "";

57 try {

58 out = (0, node_child_process_1.execSync)(`powershell -NoProfile -NonInteractive -Command "${ps}"`, {

59 encoding: "utf-8",

60 stdio: ["pipe", "pipe", "ignore"],

61 });

62 }

63 catch {

dist/autostart.jsView file

Lines 26-66javascript

26});

27var __importStar = (this && this.__importStar) || (function () {

28 var ownKeys = function(o) {

29 ownKeys = Object.getOwnPropertyNames || function (o

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 20923136 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 20923136 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 20923136 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg