registry  /  @wujie-shell/create  /  1.0.7

@wujie-shell/create@1.0.7

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 52 file(s), 247 KB of source, external domains: 127.0.0.1, gitee.com

Source & flagged code

5 flagged · loading source
bin/create-shell-app.mjsView file
9upgradeShellDependencies, L10: } = await import( L11: existsSync(new URL('../dist/src/scaffold.mjs', import.meta.url))
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/create-shell-app.mjsView on unpkg · L9
dist/bin/create-shell-app.mjsView file
1#!/usr/bin/env node L2: const _0x24f4e2=_0x16b1;(function(_0x15ef7d,_0x21807b){const _0x63e2b1=_0x16b1,_0x5e49fb=_0x15ef7d();while(!![]){try{const _0xbbcae3=parseInt(_0x63e2b1(0x1f0))/0x1+parseInt(_0x63e2...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/bin/create-shell-app.mjsView on unpkg · L1
dist/bundled-templates/templates/photo-sorter/skills/photo-face-sorter/scripts/query_photos.pyView file
•path = dist/bundled-templates/templates/photo-sorter/skills/photo-face-sorter/scripts/query_photos.py kind = build_helper sizeBytes = 6088 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bundled-templates/templates/photo-sorter/skills/photo-face-sorter/scripts/query_photos.pyView on unpkg
dist/bundled-templates/templates/_base/build/icons/icon.icnsView file
•path = dist/bundled-templates/templates/_base/build/icons/icon.icns kind = high_entropy_blob sizeBytes = 181917 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/bundled-templates/templates/_base/build/icons/icon.icnsView on unpkg
dist/docs/wujie-ai-business.mdView file
174patternName = generic_password severity = medium line = 174 matchedText = password...rd',
Medium
Secret Pattern

Hardcoded password in dist/docs/wujie-ai-business.md

dist/docs/wujie-ai-business.mdView on unpkg · L174

Findings

3 High6 Medium5 Low
HighObfuscated Payload Loaderdist/bin/create-shell-app.mjs
HighObfuscated
HighShips High Entropy Blobdist/bundled-templates/templates/_base/build/icons/icon.icns
MediumDynamic Requirebin/create-shell-app.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/bundled-templates/templates/photo-sorter/skills/photo-face-sorter/scripts/query_photos.py
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/docs/wujie-ai-business.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License