Static Scan Results
scanned 6d ago · by rust-scannerStatic analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcedist/index.jsView file
20636patternName = github_pat
severity = critical
line = 20636
matchedText = githubTo...89",
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/index.jsView on unpkg · L2063629394label: "Vulnerability Detection",
L29395: prompt: 'Review this code for security issues:\n```ts\napp.get("/api/user", (req, res) => {\n const id = req.query.id;\n const user = db.query("SELECT * FROM users WHERE id = " +...
L29396: },
...
L29398: label: "Bug Diagnosis",
L29399: prompt: 'This async function has 2 bugs. Find and fix both:\n```ts\nasync function processBatch(items: string[]) {\n const results = [];\n for (const item of items) {\n const ...
L29400: },
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L2939429394Trigger-reachable chain: manifest.main -> dist/index.js
L29394: label: "Vulnerability Detection",
L29395: prompt: 'Review this code for security issues:\n```ts\napp.get("/api/user", (req, res) => {\n const id = req.query.id;\n const user = db.query("SELECT * FROM users WHERE id = " +...
L29396: },
...
L29398: label: "Bug Diagnosis",
L29399: prompt: 'This async function has 2 bugs. Find and fix both:\n```ts\nasync function processBatch(items: string[]) {\n const results = [];\n for (const item of items) {\n const ...
L29400: },
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L2939420636patternName = github_pat
severity = critical
line = 20636
matchedText = githubTo...89",
Critical
26import { SkillInstaller } from '@wrongstack/core/skills';
L27: import { spawn, execFile, execFileSync } from 'child_process';
L28: import { MCPRegistry, MCPServer, serveHttp, serveStdio } from '@wrongstack/mcp';
High
606".bash": "Shell",
L607: ".ps1": "PowerShell",
L608: ".pl": "Perl",
High
9Detached bundled service listener: dist/index.js launches a Node helper and exposes a broad-bound HTTP listener.
L9: import { createHash, randomUUID, randomBytes, timingSafeEqual } from 'crypto';
L10: import * as http from 'http';
L11: import { createServer } from 'http';
...
L26: import { SkillInstaller } from '@wrongstack/core/skills';
L27: import { spawn, execFile, execFileSync } from 'child_process';
L28: import { MCPRegistry, MCPServer, serveHttp, serveStdio } from '@wrongstack/mcp';
...
L118: try {
L119: parsed = JSON.parse(raw);
L120: } catch (err) {
...
L297: try {
L298: const pkg = JSON.parse(await fs5.readFile(path5.join(root, "package.json"), "utf8"));
L299: const scripts = pkg.scripts ?? {};
High
Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist/index.jsView on unpkg · L9750try {
L751: const mod = await import(spec);
L752: if (mod.default) userPlugins.push(mod.default);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L750Findings
4 Critical3 High4 Medium4 Low
CriticalCritical Secretdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalSecret Patterndist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSpawned Bundled Service Listenerdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings