Static Scan Results
scanned 3h ago · by rust-scannerStatic analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcebin/vdart.cjsView file
1#!/usr/bin/env node
L2: const { spawnSync } = require("child_process")
L3: const fs = require("fs")
High
1#!/usr/bin/env node
L2: const { spawnSync } = require("child_process")
L3: const fs = require("fs")
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/vdart.cjsView on unpkg · L1src/lsp/server.tsView file
1import type { ChildProcessWithoutNullStreams } from "child_process"
L2: import path from "path"
...
L22: const run = (cmd: string[], opts: Process.RunOptions = {}) => Process.run(cmd, { ...opts, nothrow: true })
L23: const output = (cmd: string[], opts: Process.RunOptions = {}) => Process.text(cmd, { ...opts, nothrow: true })
L24:
...
L117: root: NearestRoot(
L118: ["package-lock.json", "bun.lockb", "bun.lock", "pnpm-lock.yaml", "yarn.lock"],
L119: ["deno.json", "deno.jsonc"],
...
L129: env: {
L130: ...process.env,
L131: },
...
L182: if (flags.disableLspDownload) return
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
src/lsp/server.tsView on unpkg · L11import type { ChildProcessWithoutNullStreams } from "child_process"
L2: import path from "path"
...
L22: const run = (cmd: string[], opts: Process.RunOptions = {}) => Process.run(cmd, { ...opts, nothrow: true })
L23: const output = (cmd: string[], opts: Process.RunOptions = {}) => Process.text(cmd, { ...opts, nothrow: true })
L24:
...
L117: root: NearestRoot(
L118: ["package-lock.json", "bun.lockb", "bun.lock", "pnpm-lock.yaml", "yarn.lock"],
L119: ["deno.json", "deno.jsonc"],
...
L129: env: {
L130: ...process.env,
L131: },
...
L182: if (flags.disableLspDownload) return
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/lsp/server.tsView on unpkg · L1Findings
1 Critical3 High4 Medium5 Low
CriticalCommand Output Exfiltrationsrc/lsp/server.ts
HighChild Processbin/vdart.cjs
HighShell
HighSandbox Evasion Gated Capabilitysrc/lsp/server.ts
MediumDynamic Requirebin/vdart.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings