registry / @wpro-eng/opencode-config / 1.22.0

@wpro-eng/opencode-config@1.22.0

Wpromote OpenCode plugin to sync team config assets on startup

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 5 file(s), 475 KB of source, external domains: github.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 159-199javascript

159 if (typeof val.length === "number" && typeof val.callee === "function") {

160 return true;

161 }

162 } catch (err) {

163 if (err.message.indexOf("callee") !== -1) {

164 return true;

165 }

166 }

167 return false;

168 }

169 function isBuffer(val) {

170 if (val.constructor && typeof val.constructor.isBuffer === "function") {

171 return val.constructor.isBuffer(val);

172 }

173 return false;

174 }

175});

176

177// node_modules/is-extendable/index.js

178var require_is_extendable = __commonJS((exports, module) => {

179 /*!

180 * is-extendable <https://github.com/jonschlinkert/is-extendable>

181 *

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L179

183 * Licensed under the MIT License.

184 */

185 module.exports = function isExtendable(val) {

186 return typeof val !== "undefined" && val !== null && (typeof val === "object" || typeof val === "function");

187 };

188});

189

190// node_modules/extend-shallow/index.js

191var require_extend_shallow = __commonJS((exports, module) => {

192 var isObject = require_is_extendable();

193 module.exports = function extend(o) {

194 if (!isObject(o)) {

195 o = {};

196 }

197 var len = arguments.length;

198 for (var i = 1;i < len; i++) {

199 var obj = arguments[i];

Lines 1358-1398javascript

1358 return false;

1359 try {

1360 var source = "(" + data + ")", ast = esprima.parse(source, { range: true });

1361 if (ast.type !== "Program" || ast.body.length !==

skill/terraform-search-import/scripts/list_resources.shView file

•path = skill/terraform-search-import/scripts/list_resources.sh kind = build_helper sizeBytes = 1287 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/terraform-search-import/scripts/list_resources.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/index.jsView file

179/*! L180: * is-extendable <https://github.com/jonschlinkert/is-extendable> L181: * ... L313: function createSection() { L314: return { key: "", data: "", content: "" }; L315: } ... L761: continue; L762: if (!isHexCode(data.charCodeAt(index))) L763: return false; ... L1378: if (ast.body[0].expression.body.type === "BlockStatement") { L1379: return new Function(params, source.slice(body[0] + 1, body[1] - 1)); L1380: }

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L179

1378if (ast.body[0].expression.body.type === "BlockStatement") { L1379: return new Function(params, source.slice(body[0] + 1, body[1] - 1)); L1380: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L1378

skill/terraform-search-import/scripts/list_resources.shView file

•path = skill/terraform-search-import/scripts/list_resources.sh kind = build_helper sizeBytes = 1287 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/terraform-search-import/scripts/list_resources.shView on unpkg

Findings

1 High3 Medium7 Low

HighObfuscated Payload Loaderdist/index.js

MediumEnvironment Vars

MediumShips Build Helperskill/terraform-search-import/scripts/list_resources.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 159-199javascript

159 if (typeof val.length === "number" && typeof val.callee === "function") {

160 return true;

161 }

162 } catch (err) {

163 if (err.message.indexOf("callee") !== -1) {

164 return true;

165 }

166 }

167 return false;

168 }

169 function isBuffer(val) {

170 if (val.constructor && typeof val.constructor.isBuffer === "function") {

171 return val.constructor.isBuffer(val);

172 }

173 return false;

174 }

175});

176

177// node_modules/is-extendable/index.js

178var require_is_extendable = __commonJS((exports, module) => {

179 /*!

180 * is-extendable <https://github.com/jonschlinkert/is-extendable>

181 *

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L179

183 * Licensed under the MIT License.

184 */

185 module.exports = function isExtendable(val) {

186 return typeof val !== "undefined" && val !== null && (typeof val === "object" || typeof val === "function");

187 };

188});

189

190// node_modules/extend-shallow/index.js

191var require_extend_shallow = __commonJS((exports, module) => {

192 var isObject = require_is_extendable();

193 module.exports = function extend(o) {

194 if (!isObject(o)) {

195 o = {};

196 }

197 var len = arguments.length;

198 for (var i = 1;i < len; i++) {

199 var obj = arguments[i];

Lines 1358-1398javascript

1358 return false;

1359 try {

1360 var source = "(" + data + ")", ast = esprima.parse(source, { range: true });

1361 if (ast.type !== "Program" || ast.body.length !==

skill/terraform-search-import/scripts/list_resources.shView file

•path = skill/terraform-search-import/scripts/list_resources.sh kind = build_helper sizeBytes = 1287 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/terraform-search-import/scripts/list_resources.shView on unpkg