Flagged — allowed with a warning
Allowed by default policy, but 14 finding(s) warrant review before installing.
Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
SourceChildProcessEnvironmentVarsNetworkWebSocket
Supply chainHighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 10 file(s), 1.82 MB of source, external domains: aomediacodec.github.io, api.urun.sh, session-api.use2.prod.cloud.urun.sh, session-api.usw2.prod.cloud.urun.sh, www.ietf.org, www.webrtc.org
Source & flagged code
7 flagged · loading source8patternName = generic_password
severity = medium
line = 8
matchedText = `}});var... H};
MediumSecret Pattern
Package contains a possible secret pattern.
dist/chunk-ZBJCOKGC.mjsView on unpkg · L8 •matchType = previous_version_dangerous_delta
matchedPackage = @urun-sh/core@0.2.25
matchedIdentity = npm:QHVydW4tc2gvY29yZQ:0.2.25
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
HighPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/internal.jsView on unpkg 7patternName = generic_password
severity = medium
line = 7
matchedText = `}});var...a});
3patternName = generic_password
severity = medium
line = 3
matchedText = `}});var...0}}}
MediumSecret Pattern
Hardcoded password in dist/index.browser.js
dist/index.browser.jsView on unpkg · L3 7patternName = generic_password
severity = medium
line = 7
matchedText = `}});var...r});
3patternName = generic_password
severity = medium
line = 3
matchedText = `}});var...)}}}
MediumSecret Pattern
Hardcoded password in dist/internal.browser.js
dist/internal.browser.jsView on unpkg · L3 3patternName = generic_password
severity = medium
line = 3
matchedText = `}});var... H};
MediumSecret Pattern
Hardcoded password in dist/chunk-RITHWXCZ.mjs
dist/chunk-RITHWXCZ.mjsView on unpkg · L3 Findings
2 High9 Medium3 Low
HighObfuscated
HighPrevious Version Dangerous Deltadist/internal.js
MediumSecret Patterndist/chunk-ZBJCOKGC.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/internal.js
MediumSecret Patterndist/index.browser.js
MediumSecret Patterndist/index.js
MediumSecret Patterndist/internal.browser.js
MediumSecret Patterndist/chunk-RITHWXCZ.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Source & flagged code
7 flaggedLines 1-9javascript
1import { createRequire as __urunCreateRequire } from 'node:module'; const require = globalThis.require ?? __urunCreateRequire(import.meta.url);
2var Yn=Object.create;var St=Object.defineProperty;var Jn=Object.getOwnPropertyDescriptor;var Xn=Object.getOwnPropertyNames;var Zn=Object.getPrototypeOf,ea=Object.prototype.hasOwnProperty;var bs=(s=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(s,{get:(e,t)=>(typeof require<"u"?require:e)[t]}):s)(function(s){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+s+'" is not supported')});var ta=(s,e,t)=>()=>{if(t)throw t[0];try{return s&&(e=s(s=0)),e}catch(r){throw t=[r],r}};var R=(s,e)=>()=>{try{return e||s((e={exports:{}}).exports,e),e.exports}ca ...
4`+n),s.push(i+"m+"+Lt.exports.humanize(this.diff)+"\x1B[0m")}else s[0]=Da()+e+" "+s[0]}function Da(){return F.inspectOpts.hideDate
5`)}function La(s){s?process.env.DEBUG=s:delete process.env.DEBUG}function Ma(){return process.env.DEBUG}function Oa(s){s.inspectOpts={};let e=Object.keys(F
6`).map(e=>e.trim()).join(" ")};Ys.O=function(s){return this.inspectOpts.colors=this.useColors,It.inspect(s,this.inspectOpts)}});var rt=R((sp,wr)=>{"use strict";typeof
8`}});var he=R(oe=>{"use strict";var Te=zi(),Qo=Bi(),Yo=Ht();oe.grammar=Yo;oe.write=Qo;oe.parse=Te.parse;oe.parseParams=Te.parseParams;oe.parseFmtpConfig=Te.parseFmtpConfig;oe.parsePayloads=Te.parsePayloads;oe.parseRemoteCandidates=Te.parseRemoteCandidates;oe.parseImageAttributes=Te.parseImageAttributes;oe.parseSimulcastStreamList=Te.parseSimulcastStreamList});var Ee=R(Ur=>{"use strict";Object.defineProperty
Long lines were clipped for display.
Lines 1-8javascript
1"use strict";var Yn=Object.create;var Ct=Object.defineProperty;var Qn=Object.getOwnPropertyDescriptor;var Jn=Object.getOwnPropertyNames;var Xn=Object.getPrototypeOf,Zn=Object.prototype.hasOwnProperty;var ea=(s,e,t)=>()=>
Lines 1-4javascript
1"use strict";var Xa=Object.create;var wr=Object.defineProperty;var Za=Object.getOwnPropertyDescriptor;var ec=Object.getOwnPropertyNames;var tc=Object.getPrototypeOf,rc=Object.prototype.hasOwnProperty;var P=(s,e)=>()=>{
Lines 1-8javascript
1"use strict";var vc=Object.create;var Tr=Object.defineProperty;var wc=Object.getOwnPropertyDescriptor;var yc=Object.getOwnPropertyNames;var bc=Object.getPrototypeOf,Sc=Object.prototype.hasOwnProperty;var Tc=(s,e,t)=>()=>
Lines 1-4javascript
1"use strict";var Pn=Object.create;var wt=Object.defineProperty;var Dn=Object.getOwnPropertyDescriptor;var In=Object.getOwnPropertyNames;var Ln=Object.getPrototypeOf,Mn=Object.prototype.hasOwnProperty;var T=(s,e)=>()=>{
Lines 1-4javascript
1var In=Object.create;var ds=Object.defineProperty;var Ln=Object.getOwnPropertyDescriptor;var Mn=Object.getOwnPropertyNames;var On=Object.getPrototypeOf,An=Object.prototype.hasOwnProperty;var T=(s,e)=>()=>{try{
?
""
:
new
Date
().
toISOString
()+
" "
}
function
Ia
(
...
s
){
return
process
.
stderr
.
write
(
It
.
formatWithOptions
(
F
.
inspectOpts
,...
s
)+
`
.inspectOpts);
for
(
let
t
=
0
;
t
<e.length;
t
++)s.inspectOpts[e[t]]=F.inspectOpts[e[t]]}
Lt
.
exports
=
gr
()(
F
);
var
{
formatters
:
Ys
}=
Lt
.
exports
;
Ys
.
o
=
function
(
s
){
return
this
.
inspectOpts
.
colors
=
this
.useColors,
It
.
inspect
(
s
,this.inspectOpts).
split
(
`
process>
"u"
||
process
.
type
===
"renderer"
||
process
.
browser
===
!
0
||
process
.
__nwjs
?
wr
.
exports
=
Vs
():wr.exports
=
Js
()});
var
Zs
=
R
(
Xs
=>
{
"use strict"
;Object.defineProperty(Xs,
"__esModule"
,{
value
:
!
0
})});
var
z
=
R
(
Mt
=>
{
"use strict"
;Object.defineProperty(Mt,
"__esModule"
,{
value
:
!
0
});Mt.Logger
=void
0
;var Oe
=
rt
(),Ae
=
"media-client"
,yr
=class
{
_debug
;
_warn
;
_error
;
constructor
(
e
){e
?
(
this
._debug
=
(
0
,Oe.default)(
`${
Ae
}:${
e
}`
),
this
._warn
=
(
0
,Oe.default)(
`${
Ae
} ...
(Ur,
"__esModule"
,{value:
!
0
});Ur.parse
=
Xo;
var
Jo
=new
RegExp
(
"^[LS]([1-9]
\\
d{0,1})T([1-9]
\\
d{0,1})"
);
function
Xo
(
s
){
let
e
=
Jo.
exec
(s
??
""
);
return
e
?
{spatialLayers:
Number
(e[
1
]),temporalLayers:Num
...
MediumSecret Pattern
Package contains a possible secret pattern.
dist/chunk-ZBJCOKGC.mjsView on unpkg · L8 {
if
(t)
throw
t[
0
];
try
{
return
s
&&
(e
=
s
(s
=
0
)),e}
catch
(r){
throw
t
=
[r],r}};
var
C
=
(
s
,
e
)
=>
()
=>
{
try
{
return
e
||
s
((e
=
{exports:{}}).exports,e),e.exports}
catch
(t){
throw
e
=
0
,t}},
Ds
=
(
s
,
e
)
=>
{
for
(
var
t
in
e)
Ct
(s,t,{get:e[t],enumerable:
!
0
})},
Is
=
(
s
,
e
,
t
,
r
)
=>
{
if
(e
&&typeof
e
==
"object"
||typeof
e
==
"function"
)
for
(
let
i
of
Jn
(e))
!
Zn.
call
(s,i)
&&
i
!==
t
&&
Ct
(s,i,{
get
:()
=>
e[i],enumerable:
!
(r
=
Qn
(e,i))
||
r.enume
...
3`+n),s.push(i+"m+"+Pt.exports.humanize(this.diff)+"\x1B[0m")}else s[0]=ba()+e+" "+s[0]}function ba(){return F.inspectOpts.hideDate?"":new Date().toISOString()+" "}function Sa(...s){return process.stderr.write(xt.formatWithOptions(F.inspectOpts,...s)+`
4`)}function Ca(s){s?process.env.DEBUG=s:delete process.env.DEBUG}function Ra(){return process.env.DEBUG}function Ta(s){s.inspectOpts={};let e=Object.keys(F.inspectOpts);for(let t=0;t<e.length;t++)s.inspectOpts[e[t]]=F.inspectOpts[e[t]]}Pt.exports=Sr()(F);var{formatters:$s}=Pt.exports;$s.o=function(s){return this.inspectOpts.colors=this.useColors,xt.inspect(s,this.inspectOpts).split(`
5`).map(e=>e.trim()).join(" ")};$s.O=function(s){return this.inspectOpts.colors=this.useColors,xt.inspect(s,this.inspectOpts)}});var st=C((Fd,Tr)=>{"use strict";typeof process>"u"||process.type==="renderer"||process.browser===!0||process.__nwjs?Tr.exports=Ns():Tr.exports=zs()});var Bs=C(Us=>{"use strict";Object.defineProperty(Us,"__esModule",{value:!0})});var z=C(Dt=>{"use strict";Object.defineProperty(Dt,"__esModule",{value:!0});Dt.Logger=void 0;var Le=st(),Oe="media-client",Er=class{_debug;_warn;_error;constructor(e){e?(this._debug=(0,Le.default)(`${Oe}:${e}`),this._warn=(0,Le.default)(`${Oe} ...
7`}});var ue=C(oe=>{"use strict";var Te=Ii(),$o=Li(),zo=Ut();oe.grammar=zo;oe.write=$o;oe.parse=Te.parse;oe.parseParams=Te.parseParams;oe.parseFmtpConfig=Te.parseFmtpConfig;oe.parsePayloads=Te.parsePayloads;oe.parseRemoteCandidates=Te.parseRemoteCandidates;oe.parseImageAttributes=Te.parseImageAttributes;oe.parseSimulcastStreamList=Te.parseSimulcastStreamList});var Ee=C(Kr=>{"use strict";Object.defineProperty(Kr,"__esModule",{value:!0});Kr.parse=Bo;var Uo=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function Bo(s){let e=Uo.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...
Long lines were clipped for display.
•matchType = previous_version_dangerous_delta
matchedPackage = @urun-sh/core@0.2.25
matchedIdentity = npm:QHVydW4tc2gvY29yZQ:0.2.25
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
HighPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/internal.jsView on unpkg try
{
return
e
||
s
((e
=
{exports:{}}).exports,e),e.exports}
catch
(t){
throw
e
=
0
,t}},
sc
=
(
s
,
e
)
=>
{
for
(
var
t
in
e)
wr
(s,t,{get:e[t],enumerable:
!
0
})},
ei
=
(
s
,
e
,
t
,
r
)
=>
{
if
(e
&&typeof
e
==
"object"
||typeof
e
==
"function"
)
for
(
let
n
of
ec
(e))
!
rc.
call
(s,n)
&&
n
!==
t
&&
wr
(s,n,{
get
:()
=>
e[n],enumerable:
!
(r
=
Za
(e,n))
||
r.enumerable});
return
s};
var
Ts
=
(
s
,
e
,
t
)
=>
(t
=
s
!=
null
?
Xa
(
tc
(s))
:
{},
ei
(e
||!
s
||!
s.__esModule
?
wr
(t,
"d ..
.
3`}});var be=P(fe=>{"use strict";var We=fo(),Zd=go(),el=Br();fe.grammar=el;fe.write=Zd;fe.parse=We.parse;fe.parseParams=We.parseParams;fe.parseFmtpConfig=We.parseFmtpConfig;fe.parsePayloads=We.parsePayloads;fe.parseRemoteCandidates=We.parseRemoteCandidates;fe.parseImageAttributes=We.parseImageAttributes;fe.parseSimulcastStreamList=We.parseSimulcastStreamList});var Be=P(en=>{"use strict";Object.defineProperty(en,"__esModule",{value:!0});en.parse=rl;var tl=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function rl(s){let e=tl.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...
MediumSecret Pattern
Hardcoded password in dist/index.browser.js
dist/index.browser.jsView on unpkg · L3 Long lines were clipped for display.
{
if
(t)
throw
t[
0
];
try
{
return
s
&&
(e
=
s
(s
=
0
)),e}
catch
(r){
throw
t
=
[r],r}};
var
C
=
(
s
,
e
)
=>
()
=>
{
try
{
return
e
||
s
((e
=
{exports:{}}).exports,e),e.exports}
catch
(t){
throw
e
=
0
,t}},
pi
=
(
s
,
e
)
=>
{
for
(
var
t
in
e)
Tr
(s,t,{get:e[t],enumerable:
!
0
})},
hi
=
(
s
,
e
,
t
,
r
)
=>
{
if
(e
&&typeof
e
==
"object"
||typeof
e
==
"function"
)
for
(
let
n
of
yc
(e))
!
Sc.
call
(s,n)
&&
n
!==
t
&&
Tr
(s,n,{
get
:()
=>
e[n],enumerable:
!
(r
=
wc
(e,n))
||
r.enume
...
3`+i),s.push(n+"m+"+jr.exports.humanize(this.diff)+"\x1B[0m")}else s[0]=hd()+e+" "+s[0]}function hd(){return j.inspectOpts.hideDate?"":new Date().toISOString()+" "}function fd(...s){return process.stderr.write(Fr.formatWithOptions(j.inspectOpts,...s)+`
4`)}function md(s){s?process.env.DEBUG=s:delete process.env.DEBUG}function gd(){return process.env.DEBUG}function _d(s){s.inspectOpts={};let e=Object.keys(j.inspectOpts);for(let t=0;t<e.length;t++)s.inspectOpts[e[t]]=j.inspectOpts[e[t]]}jr.exports=Us()(j);var{formatters:$i}=jr.exports;$i.o=function(s){return this.inspectOpts.colors=this.useColors,Fr.inspect(s,this.inspectOpts).split(`
5`).map(e=>e.trim()).join(" ")};$i.O=function(s){return this.inspectOpts.colors=this.useColors,Fr.inspect(s,this.inspectOpts)}});var er=C((fh,Bs)=>{"use strict";typeof process>"u"||process.type==="renderer"||process.browser===!0||process.__nwjs?Bs.exports=Fi():Bs.exports=Wi()});var zi=C(Bi=>{"use strict";Object.defineProperty(Bi,"__esModule",{value:!0})});var B=C(qr=>{"use strict";Object.defineProperty(qr,"__esModule",{value:!0});qr.Logger=void 0;var lt=er(),pt="media-client",zs=class{_debug;_warn;_error;constructor(e){e?(this._debug=(0,lt.default)(`${pt}:${e}`),this._warn=(0,lt.default)(`${pt} ...
7`}});var Re=C(_e=>{"use strict";var Ve=Ao(),Du=Oo(),Mu=Jr();_e.grammar=Mu;_e.write=Du;_e.parse=Ve.parse;_e.parseParams=Ve.parseParams;_e.parseFmtpConfig=Ve.parseFmtpConfig;_e.parsePayloads=Ve.parsePayloads;_e.parseRemoteCandidates=Ve.parseRemoteCandidates;_e.parseImageAttributes=Ve.parseImageAttributes;_e.parseSimulcastStreamList=Ve.parseSimulcastStreamList});var Ke=C(hn=>{"use strict";Object.defineProperty(hn,"__esModule",{value:!0});hn.parse=Lu;var Au=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function Lu(s){let e=Au.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...
Long lines were clipped for display.
try
{
return
e
||
s
((e
=
{exports:{}}).exports,e),e.exports}
catch
(t){
throw
e
=
0
,t}},
On
=
(
s
,
e
)
=>
{
for
(
var
t
in
e)
wt
(s,t,{get:e[t],enumerable:
!
0
})},
vs
=
(
s
,
e
,
t
,
r
)
=>
{
if
(e
&&typeof
e
==
"object"
||typeof
e
==
"function"
)
for
(
let
i
of
In
(e))
!
Mn.
call
(s,i)
&&
i
!==
t
&&
wt
(s,i,{
get
:()
=>
e[i],enumerable:
!
(r
=
Dn
(e,i))
||
r.enumerable});
return
s};
var
hr
=
(
s
,
e
,
t
)
=>
(t
=
s
!=
null
?
Pn
(
Ln
(s))
:
{},
vs
(e
||!
s
||!
s.__esModule
?
wt
(t,
"d ..
.
3`}});var de=T(ie=>{"use strict";var be=ui(),oo=mi(),co=Ot();ie.grammar=co;ie.write=oo;ie.parse=be.parse;ie.parseParams=be.parseParams;ie.parseFmtpConfig=be.parseFmtpConfig;ie.parsePayloads=be.parsePayloads;ie.parseRemoteCandidates=be.parseRemoteCandidates;ie.parseImageAttributes=be.parseImageAttributes;ie.parseSimulcastStreamList=be.parseSimulcastStreamList});var Se=T(Nr=>{"use strict";Object.defineProperty(Nr,"__esModule",{value:!0});Nr.parse=lo;var po=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function lo(s){let e=po.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...
MediumSecret Pattern
Hardcoded password in dist/internal.browser.js
dist/internal.browser.jsView on unpkg · L3 Long lines were clipped for display.
return
e
||
s
((e
=
{exports:{}}).exports,e),e.exports}
catch
(t){
throw
e
=
0
,t}};
var
Nn
=
(
s
,
e
,
t
,
r
)
=>
{
if
(e
&&typeof
e
==
"object"
||typeof
e
==
"function"
)
for
(
let
i
of
Mn
(e))
!
An.
call
(s,i)
&&
i
!==
t
&&
ds
(s,i,{
get
:()
=>
e[i],enumerable:
!
(r
=
Ln
(e,i))
||
r.enumerable});
return
s};
var
ps
=
(
s
,
e
,
t
)
=>
(t
=
s
!=
null
?
In
(
On
(s))
:
{},
Nn
(e
||!
s
||!
s.__esModule
?
ds
(t,
"default"
,{value:s,enumerable:
!
0
})
:
t,s));
var
Ds
=
T
((
md
,
Ps
)
=>
{
"use strict ..
.
3`}});var pe=T(ie=>{"use strict";var Se=Si(),lo=Ci(),uo=jt();ie.grammar=uo;ie.write=lo;ie.parse=Se.parse;ie.parseParams=Se.parseParams;ie.parseFmtpConfig=Se.parseFmtpConfig;ie.parsePayloads=Se.parsePayloads;ie.parseRemoteCandidates=Se.parseRemoteCandidates;ie.parseImageAttributes=Se.parseImageAttributes;ie.parseSimulcastStreamList=Se.parseSimulcastStreamList});var Re=T(Dr=>{"use strict";Object.defineProperty(Dr,"__esModule",{value:!0});Dr.parse=mo;var ho=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function mo(s){let e=ho.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...
MediumSecret Pattern
Hardcoded password in dist/chunk-RITHWXCZ.mjs
dist/chunk-RITHWXCZ.mjsView on unpkg · L3 Long lines were clipped for display.