registry  /  @wujie-shell/create  /  1.0.5

@wujie-shell/create@1.0.5

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 52 file(s), 246 KB of source, external domains: 127.0.0.1

Source & flagged code

5 flagged · loading source
bin/create-shell-app.mjsView file
9upgradeShellDependencies, L10: } = await import( L11: existsSync(new URL('../dist/src/scaffold.mjs', import.meta.url))
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/create-shell-app.mjsView on unpkg · L9
dist/bin/create-shell-app.mjsView file
1#!/usr/bin/env node L2: const _0x28e9f1=_0x422f;(function(_0x304530,_0x1f810b){const _0x463fd2=_0x422f,_0x2c3da6=_0x304530();while(!![]){try{const _0x2a0bb6=parseInt(_0x463fd2(0x11d))/0x1+parseInt(_0x463f...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/bin/create-shell-app.mjsView on unpkg · L1
dist/bundled-templates/templates/photo-sorter/skills/photo-face-sorter/scripts/query_photos.pyView file
•path = dist/bundled-templates/templates/photo-sorter/skills/photo-face-sorter/scripts/query_photos.py kind = build_helper sizeBytes = 6088 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bundled-templates/templates/photo-sorter/skills/photo-face-sorter/scripts/query_photos.pyView on unpkg
dist/bundled-templates/templates/_base/build/icons/icon.icnsView file
•path = dist/bundled-templates/templates/_base/build/icons/icon.icns kind = high_entropy_blob sizeBytes = 181917 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/bundled-templates/templates/_base/build/icons/icon.icnsView on unpkg
dist/docs/wujie-ai-business.mdView file
96patternName = generic_password severity = medium line = 96 matchedText = password...rd',
Medium
Secret Pattern

Hardcoded password in dist/docs/wujie-ai-business.md

dist/docs/wujie-ai-business.mdView on unpkg · L96

Findings

3 High6 Medium5 Low
HighObfuscated Payload Loaderdist/bin/create-shell-app.mjs
HighObfuscated
HighShips High Entropy Blobdist/bundled-templates/templates/_base/build/icons/icon.icns
MediumDynamic Requirebin/create-shell-app.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/bundled-templates/templates/photo-sorter/skills/photo-face-sorter/scripts/query_photos.py
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/docs/wujie-ai-business.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License