registry / @urun-sh/core / 0.2.30

@urun-sh/core@0.2.30

Core transport and channel primitives for the urun TypeScript SDK

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 1.82 MB of source, external domains: aomediacodec.github.io, api.urun.sh, session-api.use2.prod.cloud.urun.sh, session-api.usw2.prod.cloud.urun.sh, www.ietf.org, www.webrtc.org

Source & flagged code

7 flagged

dist/chunk-ZBJCOKGC.mjsView file

Lines 1-9javascript

1import { createRequire as __urunCreateRequire } from 'node:module'; const require = globalThis.require ?? __urunCreateRequire(import.meta.url);

2var Yn=Object.create;var St=Object.defineProperty;var Jn

Source & flagged code

7 flagged · loading source

dist/chunk-ZBJCOKGC.mjsView file

8patternName = generic_password severity = medium line = 8 matchedText = `}});var... H};

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunk-ZBJCOKGC.mjsView on unpkg · L8

dist/internal.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @urun-sh/core@0.2.25 matchedIdentity = npm:QHVydW4tc2gvY29yZQ:0.2.25 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/internal.jsView on unpkg

7patternName = generic_password severity = medium line = 7 matchedText = `}});var...a});

Medium

Secret Pattern

Hardcoded password in dist/internal.js

dist/internal.jsView on unpkg · L7

dist/index.browser.jsView file

3patternName = generic_password severity = medium line = 3 matchedText = `}});var...0}}}

Medium

Secret Pattern

Hardcoded password in dist/index.browser.js

dist/index.browser.jsView on unpkg · L3

dist/index.jsView file

7patternName = generic_password severity = medium line = 7 matchedText = `}});var...r});

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L7

dist/internal.browser.jsView file

3patternName = generic_password severity = medium line = 3 matchedText = `}});var...)}}}

Medium

Secret Pattern

Hardcoded password in dist/internal.browser.js

dist/internal.browser.jsView on unpkg · L3

dist/chunk-RITHWXCZ.mjsView file

3patternName = generic_password severity = medium line = 3 matchedText = `}});var... H};

Medium

Secret Pattern

Hardcoded password in dist/chunk-RITHWXCZ.mjs

dist/chunk-RITHWXCZ.mjsView on unpkg · L3

Findings

2 High9 Medium3 Low

HighObfuscated

HighPrevious Version Dangerous Deltadist/internal.js

MediumSecret Patterndist/chunk-ZBJCOKGC.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/internal.js

MediumSecret Patterndist/index.browser.js

MediumSecret Patterndist/index.js

MediumSecret Patterndist/internal.browser.js

MediumSecret Patterndist/chunk-RITHWXCZ.mjs

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

dist/internal.jsView file

Lines 1-8javascript

1"use strict";var Yn=Object.create;var Ct=Object.defineProperty;var Qn=Object.getOwnPropertyDescriptor;var Jn=Object.getOwnPropertyNames;var Xn=Object.getPrototypeOf,Zn=Object.prototype.hasOwnProperty;var ea=(s,e,t)=>()=>{if(t)throw t[0];try{return s&&(e=s(s=0)),e}catch(r){throw t=[r],r}};var C=(s,e)=>()=>{try{return e||s((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}},Ds=(s,e)=>{for(var t in e)Ct(s,t,{get:e[t],enumerable:!0})},Is=(s,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of Jn(e))!Zn.call(s,i)&&i!==t&&Ct(s,i,{get:()=>e[i],enumerable:!(r=Qn(e,i))||r.enume ...

2`).join(`

3`+n),s.push(i+"m+"+Pt.exports.humanize(this.diff)+"\x1B[0m")}else s[0]=ba()+e+" "+s[0]}function ba(){return F.inspectOpts.hideDate?"":new Date().toISOString()+" "}function Sa(...s){return process.stderr.write(xt.formatWithOptions(F.inspectOpts,...s)+`

4`)}function Ca(s){s?process.env.DEBUG=s:delete process.env.DEBUG}function Ra(){return process.env.DEBUG}function Ta(s){s.inspectOpts={};let e=Object.keys(F.inspectOpts);for(let t=0;t<e.length;t++)s.inspectOpts[e[t]]=F.inspectOpts[e[t]]}Pt.exports=Sr()(F);var{formatters:$s}=Pt.exports;$s.o=function(s){return this.inspectOpts.colors=this.useColors,xt.inspect(s,this.inspectOpts).split(`

5`).map(e=>e.trim()).join(" ")};$s.O=function(s){return this.inspectOpts.colors=this.useColors,xt.inspect(s,this.inspectOpts)}});var st=C((Fd,Tr)=>{"use strict";typeof process>"u"||process.type==="renderer"||process.browser===!0||process.__nwjs?Tr.exports=Ns():Tr.exports=zs()});var Bs=C(Us=>{"use strict";Object.defineProperty(Us,"__esModule",{value:!0})});var z=C(Dt=>{"use strict";Object.defineProperty(Dt,"__esModule",{value:!0});Dt.Logger=void 0;var Le=st(),Oe="media-client",Er=class{_debug;_warn;_error;constructor(e){e?(this._debug=(0,Le.default)(`${Oe}:${e}`),this._warn=(0,Le.default)(`${Oe} ...

6`)+`\r

7`}});var ue=C(oe=>{"use strict";var Te=Ii(),$o=Li(),zo=Ut();oe.grammar=zo;oe.write=$o;oe.parse=Te.parse;oe.parseParams=Te.parseParams;oe.parseFmtpConfig=Te.parseFmtpConfig;oe.parsePayloads=Te.parsePayloads;oe.parseRemoteCandidates=Te.parseRemoteCandidates;oe.parseImageAttributes=Te.parseImageAttributes;oe.parseSimulcastStreamList=Te.parseSimulcastStreamList});var Ee=C(Kr=>{"use strict";Object.defineProperty(Kr,"__esModule",{value:!0});Kr.parse=Bo;var Uo=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function Bo(s){let e=Uo.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...

Medium

Secret Pattern

Hardcoded password in dist/internal.js

dist/internal.jsView on unpkg · L7

Long lines were clipped for display.

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/internal.jsView on unpkg

dist/index.browser.jsView file

Lines 1-4javascript

1"use strict";var Xa=Object.create;var wr=Object.defineProperty;var Za=Object.getOwnPropertyDescriptor;var ec=Object.getOwnPropertyNames;var tc=Object.getPrototypeOf,rc=Object.prototype.hasOwnProperty;var P=(s,e)=>()=>{try{return e||s((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}},sc=(s,e)=>{for(var t in e)wr(s,t,{get:e[t],enumerable:!0})},ei=(s,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of ec(e))!rc.call(s,n)&&n!==t&&wr(s,n,{get:()=>e[n],enumerable:!(r=Za(e,n))||r.enumerable});return s};var Ts=(s,e,t)=>(t=s!=null?Xa(tc(s)):{},ei(e||!s||!s.__esModule?wr(t,"d ...

2`)+`\r

3`}});var be=P(fe=>{"use strict";var We=fo(),Zd=go(),el=Br();fe.grammar=el;fe.write=Zd;fe.parse=We.parse;fe.parseParams=We.parseParams;fe.parseFmtpConfig=We.parseFmtpConfig;fe.parsePayloads=We.parsePayloads;fe.parseRemoteCandidates=We.parseRemoteCandidates;fe.parseImageAttributes=We.parseImageAttributes;fe.parseSimulcastStreamList=We.parseSimulcastStreamList});var Be=P(en=>{"use strict";Object.defineProperty(en,"__esModule",{value:!0});en.parse=rl;var tl=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function rl(s){let e=tl.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...

Medium

Secret Pattern

Hardcoded password in dist/index.browser.js

dist/index.browser.jsView on unpkg · L3

Long lines were clipped for display.

dist/index.jsView file

Lines 1-8javascript

1"use strict";var vc=Object.create;var Tr=Object.defineProperty;var wc=Object.getOwnPropertyDescriptor;var yc=Object.getOwnPropertyNames;var bc=Object.getPrototypeOf,Sc=Object.prototype.hasOwnProperty;var Tc=(s,e,t)=>()=>{if(t)throw t[0];try{return s&&(e=s(s=0)),e}catch(r){throw t=[r],r}};var C=(s,e)=>()=>{try{return e||s((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}},pi=(s,e)=>{for(var t in e)Tr(s,t,{get:e[t],enumerable:!0})},hi=(s,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of yc(e))!Sc.call(s,n)&&n!==t&&Tr(s,n,{get:()=>e[n],enumerable:!(r=wc(e,n))||r.enume ...

2`).join(`

3`+i),s.push(n+"m+"+jr.exports.humanize(this.diff)+"\x1B[0m")}else s[0]=hd()+e+" "+s[0]}function hd(){return j.inspectOpts.hideDate?"":new Date().toISOString()+" "}function fd(...s){return process.stderr.write(Fr.formatWithOptions(j.inspectOpts,...s)+`

4`)}function md(s){s?process.env.DEBUG=s:delete process.env.DEBUG}function gd(){return process.env.DEBUG}function _d(s){s.inspectOpts={};let e=Object.keys(j.inspectOpts);for(let t=0;t<e.length;t++)s.inspectOpts[e[t]]=j.inspectOpts[e[t]]}jr.exports=Us()(j);var{formatters:$i}=jr.exports;$i.o=function(s){return this.inspectOpts.colors=this.useColors,Fr.inspect(s,this.inspectOpts).split(`

5`).map(e=>e.trim()).join(" ")};$i.O=function(s){return this.inspectOpts.colors=this.useColors,Fr.inspect(s,this.inspectOpts)}});var er=C((fh,Bs)=>{"use strict";typeof process>"u"||process.type==="renderer"||process.browser===!0||process.__nwjs?Bs.exports=Fi():Bs.exports=Wi()});var zi=C(Bi=>{"use strict";Object.defineProperty(Bi,"__esModule",{value:!0})});var B=C(qr=>{"use strict";Object.defineProperty(qr,"__esModule",{value:!0});qr.Logger=void 0;var lt=er(),pt="media-client",zs=class{_debug;_warn;_error;constructor(e){e?(this._debug=(0,lt.default)(`${pt}:${e}`),this._warn=(0,lt.default)(`${pt} ...

6`)+`\r

7`}});var Re=C(_e=>{"use strict";var Ve=Ao(),Du=Oo(),Mu=Jr();_e.grammar=Mu;_e.write=Du;_e.parse=Ve.parse;_e.parseParams=Ve.parseParams;_e.parseFmtpConfig=Ve.parseFmtpConfig;_e.parsePayloads=Ve.parsePayloads;_e.parseRemoteCandidates=Ve.parseRemoteCandidates;_e.parseImageAttributes=Ve.parseImageAttributes;_e.parseSimulcastStreamList=Ve.parseSimulcastStreamList});var Ke=C(hn=>{"use strict";Object.defineProperty(hn,"__esModule",{value:!0});hn.parse=Lu;var Au=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function Lu(s){let e=Au.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L7

Long lines were clipped for display.

dist/internal.browser.jsView file

Lines 1-4javascript

1"use strict";var Pn=Object.create;var wt=Object.defineProperty;var Dn=Object.getOwnPropertyDescriptor;var In=Object.getOwnPropertyNames;var Ln=Object.getPrototypeOf,Mn=Object.prototype.hasOwnProperty;var T=(s,e)=>()=>{try{return e||s((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}},On=(s,e)=>{for(var t in e)wt(s,t,{get:e[t],enumerable:!0})},vs=(s,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of In(e))!Mn.call(s,i)&&i!==t&&wt(s,i,{get:()=>e[i],enumerable:!(r=Dn(e,i))||r.enumerable});return s};var hr=(s,e,t)=>(t=s!=null?Pn(Ln(s)):{},vs(e||!s||!s.__esModule?wt(t,"d ...

2`)+`\r

3`}});var de=T(ie=>{"use strict";var be=ui(),oo=mi(),co=Ot();ie.grammar=co;ie.write=oo;ie.parse=be.parse;ie.parseParams=be.parseParams;ie.parseFmtpConfig=be.parseFmtpConfig;ie.parsePayloads=be.parsePayloads;ie.parseRemoteCandidates=be.parseRemoteCandidates;ie.parseImageAttributes=be.parseImageAttributes;ie.parseSimulcastStreamList=be.parseSimulcastStreamList});var Se=T(Nr=>{"use strict";Object.defineProperty(Nr,"__esModule",{value:!0});Nr.parse=lo;var po=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function lo(s){let e=po.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...

Medium

Secret Pattern

Hardcoded password in dist/internal.browser.js

dist/internal.browser.jsView on unpkg · L3

Long lines were clipped for display.

dist/chunk-RITHWXCZ.mjsView file

Lines 1-4javascript

1var In=Object.create;var ds=Object.defineProperty;var Ln=Object.getOwnPropertyDescriptor;var Mn=Object.getOwnPropertyNames;var On=Object.getPrototypeOf,An=Object.prototype.hasOwnProperty;var T=(s,e)=>()=>{try{return e||s((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}};var Nn=(s,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of Mn(e))!An.call(s,i)&&i!==t&&ds(s,i,{get:()=>e[i],enumerable:!(r=Ln(e,i))||r.enumerable});return s};var ps=(s,e,t)=>(t=s!=null?In(On(s)):{},Nn(e||!s||!s.__esModule?ds(t,"default",{value:s,enumerable:!0}):t,s));var Ds=T((md,Ps)=>{"use strict ...

2`)+`\r

3`}});var pe=T(ie=>{"use strict";var Se=Si(),lo=Ci(),uo=jt();ie.grammar=uo;ie.write=lo;ie.parse=Se.parse;ie.parseParams=Se.parseParams;ie.parseFmtpConfig=Se.parseFmtpConfig;ie.parsePayloads=Se.parsePayloads;ie.parseRemoteCandidates=Se.parseRemoteCandidates;ie.parseImageAttributes=Se.parseImageAttributes;ie.parseSimulcastStreamList=Se.parseSimulcastStreamList});var Re=T(Dr=>{"use strict";Object.defineProperty(Dr,"__esModule",{value:!0});Dr.parse=mo;var ho=new RegExp("^[LS]([1-9]\\d{0,1})T([1-9]\\d{0,1})");function mo(s){let e=ho.exec(s??"");return e?{spatialLayers:Number(e[1]),temporalLayers:Num ...

Medium

Secret Pattern

Hardcoded password in dist/chunk-RITHWXCZ.mjs

dist/chunk-RITHWXCZ.mjsView on unpkg · L3

Long lines were clipped for display.