registry / @viudes/windsurf-api / 0.1.1

@viudes/windsurf-api@0.1.1

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 1.25 MB of source, external domains: 0.0.0.0, 127.0.0.1, 192.168.50.7, api-us-ca.umodelverse.ai, api.codeium.com, api.devin.ai, api.modelverse.cn, app.devin.ai, bun.sh, example.com, github.com, identitytoolkit.googleapis.com, register.windsurf.com, securetoken.googleapis.com, server.self-serve.windsurf.com, windsurf.com

Source & flagged code

8 flagged

test/language-server/stream-error.test.jsView file

75patternName = aws_access_key severity = critical line = 75 matchedText = const re...P');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/language-server/stream-error.test.jsView on unpkg · L75

75patternName = aws_access_key severity = critical line = 75 matchedText = const re...P');

Critical

Secret Pattern

AWS access key ID in test/language-server/stream-error.test.js

test/language-server/stream-error.test.jsView on unpkg · L75

80patternName = aws_access_key severity = critical line = 80 matchedText = assert.d...P/);

Critical

Secret Pattern

AWS access key ID in test/language-server/stream-error.test.js

test/language-server/stream-error.test.jsView on unpkg · L80

scripts/build-exe.mjsView file

12// node builtins, so it runs under both `node` and `bun run`. L13: import { spawnSync } from 'node:child_process'; L14: import { readFileSync, rmSync, mkdirSync, existsSync, statSync, readdirSync } from 'node:fs'; ... L33: function hostTarget() { L34: const os = process.platform === 'win32' ? 'windows' : process.platform; // linux | darwin | windows L35: const arch = process.arch === 'arm64' ? 'arm64' : 'x64'; ... L45: if (spawnSync('bun', ['--version'], { encoding: 'utf-8' }).status !== 0) { L46: fail('`bun` not found on PATH. Install Bun (https://bun.sh) \u2014 it does the compiling.'); L47: } L48: L49: const buildAll = process.argv.includes('--all') || process.env.BUILD_ALL === '1'; L50: const host = hostTarget();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/build-exe.mjsView on unpkg · L12

install-ls.shView file

•path = install-ls.sh kind = build_helper sizeBytes = 6237 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-ls.shView on unpkg

test/_meta/secret-scan.test.jsView file

22patternName = generic_password severity = medium line = 22 matchedText = const pa...24);

Medium

Secret Pattern

Hardcoded password in test/_meta/secret-scan.test.js

test/_meta/secret-scan.test.jsView on unpkg · L22

25patternName = generic_password severity = medium line = 25 matchedText = writeFil...n`);

Medium

Secret Pattern

Hardcoded password in test/_meta/secret-scan.test.js

test/_meta/secret-scan.test.jsView on unpkg · L25

src/dashboard/windsurf-login.jsView file

12patternName = google_api_key severity = high line = 12 matchedText = const FI...cY';

High

Secret Pattern

Google API key in src/dashboard/windsurf-login.js

src/dashboard/windsurf-login.jsView on unpkg · L12

Source & flagged code

8 flagged · loading source

test/language-server/stream-error.test.jsView file

75patternName = aws_access_key severity = critical line = 75 matchedText = const re...P');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/language-server/stream-error.test.jsView on unpkg · L75

75patternName = aws_access_key severity = critical line = 75 matchedText = const re...P');

Critical

Secret Pattern

AWS access key ID in test/language-server/stream-error.test.js

test/language-server/stream-error.test.jsView on unpkg · L75

80patternName = aws_access_key severity = critical line = 80 matchedText = assert.d...P/);

Critical

Secret Pattern

AWS access key ID in test/language-server/stream-error.test.js

test/language-server/stream-error.test.jsView on unpkg · L80

Findings

3 Critical2 High6 Medium4 Low

CriticalCritical Secrettest/language-server/stream-error.test.js

CriticalSecret Patterntest/language-server/stream-error.test.js

HighSandbox Evasion Gated Capabilityscripts/build-exe.mjs

HighSecret Patternsrc/dashboard/windsurf-login.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall-ls.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntest/_meta/secret-scan.test.js

LowScripts Present

LowFilesystem