Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 22 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
CopyleftLicense
Oversized source lightweight scan
dist/assets/index-8A4JLNIp.js9.61 MB file, sampled 256 KB
NetworkChildProcessHighEntropyStringsTelemetryUrlStringsreact.dev
Source & flagged code
12 flagged · loading sourcedist/ingest/racing-game/rg-entry.jsView file
1patternName = supabase_service_key
severity = critical
line = 1
matchedText = var yt=O...}));
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/ingest/racing-game/rg-entry.jsView on unpkg · L11patternName = supabase_service_key
severity = critical
line = 1
matchedText = var yt=O...}));
Critical
Secret Pattern
Supabase service role key (JWT) in dist/ingest/racing-game/rg-entry.js
dist/ingest/racing-game/rg-entry.jsView on unpkg · L1dist-server/packaged.mjsView file
1442// server/editor-server.ts
L1443: import { execFile as execFile2, spawn } from "node:child_process";
L1444: import { createHash as createHash8, randomUUID as randomUUID4 } from "node:crypto";
High
Child Process
Package source references child process execution.
dist-server/packaged.mjsView on unpkg · L144246484["install", "--no-audit", "--no-fund", "--loglevel=error"],
L46485: { cwd: projectPath2, stdio: "ignore", shell: true }
L46486: );
High
58Cross-file remote execution chain: dist-server/packaged.mjs spawns dist/ingest/simcity/index.js; helper contains network access plus dynamic code execution.
L58: res.statusCode = 403;
L59: res.end("forbidden");
L60: return;
...
L130: let h = 0;
L131: for (let i = 0; i < s.length; i++) h = Math.imul(31, h) + s.charCodeAt(i) | 0;
L132: return Math.abs(h);
...
L1027: }
L1028: function handlePrepare(store, body, projectRoot = process.cwd()) {
L1029: const kind = body["kind"];
...
L1442: // server/editor-server.ts
L1443: import { execFile as execFile2, spawn } from "node:child_process";
L1444: import { createHash as createHash8, randomUUID as randomUUID4 } from "node:crypto";
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist-server/packaged.mjsView on unpkg · L5816586try {
L16587: const req = createRequire(join5(fromDir, "package.json"));
L16588: const pkgJsonPath = req.resolve(`${packageName}/package.json`);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/packaged.mjsView on unpkg · L16586dist/ingest/tanks/tanks-entry.jsView file
22Encoder.BUFFER_SIZE = ${Math.round(c/1024)} * 1024; // ${Math.round(c/1024)} KB
L23: `);const f=new Uint8Array(c);return f.set(n),n=f,n===this.sharedBuffer&&(this.sharedBuffer=n),this.encode({offset:o},t,n,s,r)}else return n.subarray(0,e.offset)}encodeAll(e={offset...
L24: The format should be roomId:reconnectionToken`);return await this.createMatchMakeRequest("reconnect",n,{reconnectionToken:s},t)}async consumeSeatReservation(e,t){const n=this.creat...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/ingest/tanks/tanks-entry.jsView on unpkg · L22scripts/run-probe.tsView file
371return new Promise((resolvePromise) => {
L372: const child = spawn('npx', ['tsc', '--noEmit', '-p', tsconfigPath], {
L373: cwd: projectDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/run-probe.tsView on unpkg · L3719*
L10: * Run sequence (each step's own exit path; exit codes below):
L11: * 1. zero-specs usage check -> `checkZeroSpecs`
...
L58:
L59: import { type ChildProcess, spawn } from 'node:child_process';
L60: import { createHash } from 'node:crypto';
...
L72: import { createRequire } from 'node:module';
L73: import net from 'node:net';
L74: import { homedir } from 'node:os';
...
L374: stdio: ['ignore', 'pipe', 'pipe'],
L375: shell: process.platform === 'win32',
L376: });
Low
Weak Crypto
Package source references weak cryptographic algorithms.
scripts/run-probe.tsView on unpkg · L9dist/assets/esbuild-BHljloGq.wasmView file
•path = dist/assets/esbuild-BHljloGq.wasm
kind = wasm_module
sizeBytes = 12332677
magicHex = [redacted]
Medium
dist/ingest/racing-game/models/wheel-draco.glbView file
•path = dist/ingest/racing-game/models/wheel-draco.glb
kind = high_entropy_blob
sizeBytes = 4840
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/ingest/racing-game/models/wheel-draco.glbView on unpkgdist/assets/index-8A4JLNIp.jsView file
•path = dist/assets/index-8A4JLNIp.js
kind = oversized_source_file
sizeBytes = 10078520
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/assets/index-8A4JLNIp.jsView on unpkgFindings
2 Critical6 High5 Medium9 Low
CriticalCritical Secretdist/ingest/racing-game/rg-entry.js
CriticalSecret Patterndist/ingest/racing-game/rg-entry.js
HighChild Processdist-server/packaged.mjs
HighShelldist-server/packaged.mjs
HighCross File Remote Execution Contextdist-server/packaged.mjs
HighRuntime Package Installscripts/run-probe.ts
HighShips High Entropy Blobdist/ingest/racing-game/models/wheel-draco.glb
HighOversized Source Filedist/assets/index-8A4JLNIp.js
MediumDynamic Requiredist-server/packaged.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/assets/esbuild-BHljloGq.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/ingest/tanks/tanks-entry.js
LowWeak Cryptoscripts/run-probe.ts
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowCopyleft License