Static Scan Results
scanned 1d ago · by rust-scannerStatic analysis flagged 17 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
5import './chunk-UPPWLMVD.js';
L6: import { execFileSync } from 'child_process';
L7:
High
dist/cli.jsView file
1#!/usr/bin/env node
L2: import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, e...
L3: import { resolvedGrammarFiles, grammarSetVersion } from './chunk-X5YT263H.js';
...
L13: import { Command, CommanderError, Option } from 'commander';
L14: import { execSync, spawn, execFileSync } from 'child_process';
L15: import chalk5 from 'chalk';
...
L21: function info(message = "") {
L22: process.stderr.write(`${message}
L23: `);
...
L273: function rel(root) {
L274: const r = path9.relative(process.cwd(), root);
L275: return r === "" ? "." : r;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L11Trigger-reachable chain: manifest.bin -> dist/cli.js
L1: #!/usr/bin/env node
L2: import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, e...
L3: import { resolvedGrammarFiles, grammarSetVersion } from './chunk-X5YT263H.js';
...
L13: import { Command, CommanderError, Option } from 'commander';
L14: import { execSync, spawn, execFileSync } from 'child_process';
L15: import chalk5 from 'chalk';
...
L21: function info(message = "") {
L22: process.stderr.write(`${message}
L23: `);
...
L273: function rel(root) {
L274: const r = path9.relative(process.cwd(), root);
L275: return r === "" ? "." : r;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkg · L13132if (platform === "win32") {
L3133: return `PowerShell: Remove-Item Env:${varName} | cmd.exe: set ${varName}=`;
L3134: }
High
1Cross-file remote execution chain: dist/cli.js spawns dist/chunk-WGXDYBAN.js; helper contains network access plus dynamic code execution.
L1: #!/usr/bin/env node
L2: import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, e...
L3: import { resolvedGrammarFiles, grammarSetVersion } from './chunk-X5YT263H.js';
...
L13: import { Command, CommanderError, Option } from 'commander';
L14: import { execSync, spawn, execFileSync } from 'child_process';
L15: import chalk5 from 'chalk';
...
L21: function info(message = "") {
L22: process.stderr.write(`${message}
L23: `);
...
L273: function rel(root) {
L274: const r = path9.relative(process.cwd(), root);
L275: return r === "" ? "." : r;
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli.jsView on unpkg · L1dist/chunk-QWS7M7DG.jsView file
2334async function findPythonManifests(rootDir) {
L2335: const { findFiles: findFiles2 } = await import('./fs-DSQZWBO5.js');
L2336: return findFiles2(rootDir, (name) => PYTHON_MANIFEST_FILES.has(name) || /^requirements.*\.txt$/.test(name));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-QWS7M7DG.jsView on unpkg · L2334dist/chunk-WGXDYBAN.jsView file
25L26: var NPX_INVOCATION = "npx @vibgrate/cli";
L27: function whichOnPath(cmd) {
L28: try {
L29: const out = execFileSync(process.platform === "win32" ? "where" : "which", [cmd], {
L30: encoding: "utf8",
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/chunk-WGXDYBAN.jsView on unpkg · L25grammars/tree-sitter-go.wasmView file
•path = grammars/tree-sitter-go.wasm
kind = wasm_module
sizeBytes = 235957
magicHex = [redacted]
Medium
Findings
2 Critical5 High6 Medium4 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelldist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighRuntime Package Installdist/chunk-WGXDYBAN.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/chunk-QWS7M7DG.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulegrammars/tree-sitter-go.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings