@wireio/debugging-client-tool@0.1.16: Suspicious npm security

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 1.78 MB of source, external domains: github.com, goo.gl, npms.io, stackoverflow.com, www.typescriptlang.org, yargs.js.org

Source & flagged code

5 flagged

dist/bundle/wire-debugging-client-tool.cjsView file

18262var methodName = "on" + name.toLowerCase(); L18263: var method = util.global[methodName]; L18264: if (!method) return false;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/bundle/wire-debugging-client-tool.cjsView on unpkg · L18262

1#!/usr/bin/env node L2: var import_meta_url = require('url').pathToFileURL(__filename).href; L3: var __create = Object.create;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bundle/wire-debugging-client-tool.cjsView on unpkg · L1

28L29: // ../../node_modules/.pnpm/source-map@0.6.1/node_modules/source-map/lib/base64.js L30: var require_base64 = __commonJS({ ... L137: var urlRegexp = /^(?:([\w+\-.]+):)?\/\/(?:(\w+:\w+)@)?([\w.-]*)(?::(\d+))?(.*)$/; L138: var dataUrlRegexp = /^data:.+\,.+$/; L139: function urlParse(aUrl) { ... L1855: return false; L1856: return typeof window !== "undefined" && typeof XMLHttpRequest === "function" && !(window.require && window.module && window.process && window.process.type === "renderer"); L1857: } ... L1867: } L1868: function globalProcessStderr() { L1869: if (typeof process === "object" && process !== null) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bundle/wire-debugging-client-tool.cjsView on unpkg · L28

17112return obj; L17113: eval(obj); L17114: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bundle/wire-debugging-client-tool.cjsView on unpkg · L17112

28L29: // ../../node_modules/.pnpm/source-map@0.6.1/node_modules/source-map/lib/base64.js L30: var require_base64 = __commonJS({ ... L137: var urlRegexp = /^(?:([\w+\-.]+):)?\/\/(?:(\w+:\w+)@)?([\w.-]*)(?::(\d+))?(.*)$/; L138: var dataUrlRegexp = /^data:.+\,.+$/; L139: function urlParse(aUrl) { ... L1855: return false; L1856: return typeof window !== "undefined" && typeof XMLHttpRequest === "function" && !(window.require && window.module && window.process && window.process.type === "renderer"); L1857: } ... L1867: } L1868: function globalProcessStderr() { L1869: if (typeof process === "object" && process !== null) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bundle/wire-debugging-client-tool.cjsView on unpkg · L28

Source & flagged code

5 flagged · loading source

dist/bundle/wire-debugging-client-tool.cjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code