registry / @unclesaliva/java-ai-debugger / 1.1.6

@unclesaliva/java-ai-debugger@1.1.6

⚠ Under review

Java AI Debugger — MCP server (TypeScript) for remote JVM debugging via JDWP

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 76.8 KB of source, external domains: 127.0.0.1

Source & flagged code

7 flagged

dist/stop.jsView file

Lines 23-63javascript

23 o["default"] = v;

24});

25var __importStar = (this && this.__importStar) || (function () {

26 var ownKeys = function(o) {

27 ownKeys = Object.getOwnPropertyNames || function (o) {

28 var ar = [];

29 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

30 return ar;

31 };

32 return ownKeys(o);

33 };

34 return function (mod) {

35 if (mod && mod.__esModule) return mod;

36 var result = {};

37 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

38 __setModuleDefault(result, mod);

39 return result;

40 };

41})();

42Object.defineProperty(exports, "__esModule", { value: true });

43exports.stopCommand = stopCommand;

44const node_child_process_1 = require("node:child_process");

45const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

46const config_js_1 = require("./config.js");

47/**

48 * 按命令行关键字查找并终止进程，返回是否杀到了进程。

49 * - win32: PowerShell Get-CimInstance Win32_Process（wmic 在 Win11 已移除）。

50 * - 其他平台: pkill -f。

51 */

52function killByPattern(pattern) {

53 // 转义单引号防 PowerShell 注入（'' → ''）

54 const safe = pattern.replace(/'/g, "''");

55 if (os.platform() === "win32") {

56 const ps = `Get-CimInstance Win32_Process | ` +

57 `Where-Object { $_.CommandLine -and $_.CommandLine -like '*${safe}*' } | ` +

58 `ForEach-Object { $_.ProcessId }`;

59 let out = "";

60 try {

61 out = (0, node_child_process_1.execSync)(`powershell -NoProfile -NonInteractive -Command "${ps}"`, {

62 encoding: "utf-8",

63 stdio: ["pipe", "pipe", "ignore"],

dist/cli.jsView file

Lines 29-69javascript

29});

30var __importStar = (this && this.__importStar) || (function () {

31 var ownKeys = function(o) {

32 ownKeys = Object.getOwnPropertyNames || function (o) {

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 173963 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 173963 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 173963 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

dist/autostart.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @unclesaliva/java-ai-debugger@1.1.3 matchedIdentity = npm:[redacted]:1.1.3 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/autostart.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/stop.jsView file

43exports.stopCommand = stopCommand; L44: const node_child_process_1 = require("node:child_process"); L45: const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

dist/cli.jsView file

49const fs = __importStar(require("node:fs")); L50: const http = __importStar(require("node:http")); L51: const net = __importStar(require("node:net")); L52: const node_child_process_1 = require("node:child_process"); L53: const setup_js_1 = require("./setup.js"); ... L59: function printHelp() { L60: process.stdout.write(`java-ai-debugger v${VERSION} L61:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L49

49Cross-file remote execution chain: dist/cli.js spawns dist/autostart.js; helper contains network access plus dynamic code execution. L49: const fs = __importStar(require("node:fs")); L50: const http = __importStar(require("node:http")); L51: const net = __importStar(require("node:net")); L52: const node_child_process_1 = require("node:child_process"); L53: const setup_js_1 = require("./setup.js"); ... L55: const autostart_js_1 = require("./autostart.js"); L56: const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf-8")); L57: const VERSION = pkg.version; ... L59: function printHelp() { L60: process.stdout.write(`java-ai-debugger v${VERSION} L61: ... L116: if (!process.stdin.isTTY) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L49

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 173963 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 173963 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 173963 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

dist/autostart.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/autostart.jsView on unpkg

Findings

1 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/autostart.js

HighChild Processdist/stop.js

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Bloblib/debug-core-0.2.0-SNAPSHOT.jar

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Bloblib/debug-core-0.2.0-SNAPSHOT.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionlib/debug-core-0.2.0-SNAPSHOT.jar

Source & flagged code

7 flagged

dist/stop.jsView file

Lines 23-63javascript

23 o["default"] = v;

24});

25var __importStar = (this && this.__importStar) || (function () {

26 var ownKeys = function(o) {

27 ownKeys = Object.getOwnPropertyNames || function (o) {

28 var ar = [];

29 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

30 return ar;

31 };

32 return ownKeys(o);

33 };

34 return function (mod) {

35 if (mod && mod.__esModule) return mod;

36 var result = {};

37 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

38 __setModuleDefault(result, mod);

39 return result;

40 };

41})();

42Object.defineProperty(exports, "__esModule", { value: true });

43exports.stopCommand = stopCommand;

44const node_child_process_1 = require("node:child_process");

45const os = __importStar(require("node:os"));

High

Child Process

Package source references child process execution.

dist/stop.jsView on unpkg · L43

46const config_js_1 = require("./config.js");

47/**

48 * 按命令行关键字查找并终止进程，返回是否杀到了进程。

49 * - win32: PowerShell Get-CimInstance Win32_Process（wmic 在 Win11 已移除）。

50 * - 其他平台: pkill -f。

51 */

52function killByPattern(pattern) {

53 // 转义单引号防 PowerShell 注入（'' → ''）

54 const safe = pattern.replace(/'/g, "''");

55 if (os.platform() === "win32") {

56 const ps = `Get-CimInstance Win32_Process | ` +

57 `Where-Object { $_.CommandLine -and $_.CommandLine -like '*${safe}*' } | ` +

58 `ForEach-Object { $_.ProcessId }`;

59 let out = "";

60 try {

61 out = (0, node_child_process_1.execSync)(`powershell -NoProfile -NonInteractive -Command "${ps}"`, {

62 encoding: "utf-8",

63 stdio: ["pipe", "pipe", "ignore"],

dist/cli.jsView file

Lines 29-69javascript

29});

30var __importStar = (this && this.__importStar) || (function () {

31 var ownKeys = function(o) {

32 ownKeys = Object.getOwnPropertyNames || function (o) {

lib/debug-core-0.2.0-SNAPSHOT.jarView file

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = high_entropy_blob sizeBytes = 173963 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = compressed_blob sizeBytes = 173963 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

•path = lib/debug-core-0.2.0-SNAPSHOT.jar kind = nested_archive_needs_inspection sizeBytes = 173963 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/debug-core-0.2.0-SNAPSHOT.jarView on unpkg

dist/autostart.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/autostart.jsView on unpkg