Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
11 flagged · loading sourcedoctor-CM6AZVGM.jsView file
1445patternName = stripe_live_secret
severity = critical
line = 1445
matchedText = var fire...n}';
Critical
Critical Secret
Package contains a critical-looking secret pattern.
doctor-CM6AZVGM.jsView on unpkg · L14451445patternName = stripe_live_secret
severity = critical
line = 1445
matchedText = var fire...n}';
Critical
1445patternName = github_oauth
severity = critical
line = 1445
matchedText = var fire...n}';
Critical
Secret Pattern
GitHub OAuth access token in doctor-CM6AZVGM.js
doctor-CM6AZVGM.jsView on unpkg · L14451445patternName = sendgrid_api_key
severity = critical
line = 1445
matchedText = var fire...n}';
Critical
1445patternName = slack_bot_token
severity = critical
line = 1445
matchedText = var fire...n}';
Critical
1445patternName = supabase_service_key
severity = critical
line = 1445
matchedText = var fire...n}';
Critical
Secret Pattern
Supabase service role key (JWT) in doctor-CM6AZVGM.js
doctor-CM6AZVGM.jsView on unpkg · L14451445patternName = stripe_test_secret
severity = high
line = 1445
matchedText = var fire...n}';
High
1445patternName = google_api_key
severity = high
line = 1445
matchedText = var fire...n}';
High
esm-SRH3OR6L.jsView file
127break;
L128: baggage[keyPair.key] = keyPair.metadata ? { value: keyPair.value, metadata: keyPair.metadata } : { value: keyPair.value };
L129: count2++;
...
L378: function getNumberFromEnv(key) {
L379: const raw = process.env[key];
L380: if (raw == null || raw.trim() === "") {
...
L4436: for (let i = 0; i < namespace.length; i++) {
L4437: hash = (hash << 5) - hash + namespace.charCodeAt(i);
L4438: hash |= 0;
...
L4697: let m;
L4698: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta...
L4699: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
esm-SRH3OR6L.jsView on unpkg · L12724683patternName = generic_password
severity = medium
line = 24683
matchedText = newUrl.p...d%";
Medium
index.jsView file
123};
L124: const bypassSecret = process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
L125: if (bypassSecret) {
...
L130: async function requestDeviceCode(apiUrl) {
L131: const response = await fetch(`${apiUrl}/api/cli/auth/device`, {
L132: method: "POST",
L133: headers: headersWithCliClientHeaders(buildHeaders()),
L134: body: JSON.stringify({})
L135: });
...
L141: }
L142: return response.json();
L143: }
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
index.jsView on unpkg · L123Findings
6 Critical3 High5 Medium5 Low
CriticalCritical Secretdoctor-CM6AZVGM.js
CriticalSecret Patterndoctor-CM6AZVGM.js
CriticalSecret Patterndoctor-CM6AZVGM.js
CriticalSecret Patterndoctor-CM6AZVGM.js
CriticalSecret Patterndoctor-CM6AZVGM.js
CriticalSecret Patterndoctor-CM6AZVGM.js
HighSandbox Evasion Gated Capabilityindex.js
HighSecret Patterndoctor-CM6AZVGM.js
HighSecret Patterndoctor-CM6AZVGM.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceesm-SRH3OR6L.js
MediumStructural Risk Force Deep Review
MediumSecret Patternesm-SRH3OR6L.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License