registry  /  @xuda.io/ai_module  /  1.1.5632

@xuda.io/ai_module@1.1.5632

Xuda AI Module

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 13 file(s), 1.10 MB of source, external domains: example.com, fb.com, mcp.gotopanel.com, mcp.xuda.dev, www.w3.org, www.youtube.com, xuda.ai

Source & flagged code

5 flagged · loading source
.envView file
1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: OPENAI_API_KEY=<redacted:56 token-like>
Critical
Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1
index_ms.mjsView file
8L9: const { MessageBroker } = await import(path.join(process.env.XUDA_HOME, 'common', 'ms_broker.mjs')); L10:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

index_ms.mjsView on unpkg · L8
index.mjsView file
6import { pathToFileURL } from 'node:url'; L7: import { spawn } from 'node:child_process'; L8: ... L33: return new Promise((resolve, reject) => { L34: const { onStdout, onStderr, ...spawn_options } = options; L35: const child = spawn(command, args, { ... L64: if (input) { L65: child.stdin.write(input); L66: } ... L109: try { L110: events.push(JSON.parse(line)); L111: } catch (err) {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

index.mjsView on unpkg · L6
build_boaz_wiki.pyView file
•path = build_boaz_wiki.py kind = build_helper sizeBytes = 14922 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

build_boaz_wiki.pyView on unpkg
.sitework/boaz-wiki/assets/favicon.icoView file
•path = .sitework/boaz-wiki/assets/favicon.ico kind = high_entropy_blob sizeBytes = 151835 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.sitework/boaz-wiki/assets/favicon.icoView on unpkg

Findings

1 Critical1 High5 Medium6 Low
CriticalCritical Secret.env
HighShips High Entropy Blob.sitework/boaz-wiki/assets/favicon.ico
MediumDynamic Requireindex_ms.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbuild_boaz_wiki.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptoindex.mjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings