@workoscalifant/sudoku-term@1.0.0: Suspicious npm security report

Loading npm security reports…

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 16.1 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

prebuilt/darwin-x64/sudoku-hintView file

•path = prebuilt/darwin-x64/sudoku-hint kind = native_binary sizeBytes = 12968 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/darwin-x64/sudoku-hintView on unpkg

native/build.shView file

•path = native/build.sh kind = build_helper sizeBytes = 1466 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

native/build.shView on unpkg

src/hint.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = sudoku-term@1.0.0 matchedPath = bin/sudoku-term.js matchedIdentity = npm:c3Vkb2t1LXRlcm0:1.0.0 similarity = 1.000 shingleOverlap = 5 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

src/hint.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

@workoscalifant/sudoku-term@1.0.0: Suspicious npm security report | LPM Firewall

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code