registry / @xuda.io/misc_module / 1.1.539

@xuda.io/misc_module@1.1.539

Xuda Misc Server Module

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 147 KB of source, external domains: api.cloudflare.com, github.com, googleads.googleapis.com, graph.facebook.com, mcp.gotopanel.com, mcp.xuda.dev, oauth2.googleapis.com, registry.npmjs.org, www.npmjs.com, xuda.ai

Source & flagged code

5 flagged

.envView file

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: OPENAI_API_KEY=<redacted:56 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

index.mjsView file

Lines 1-30javascript

1import path from 'path';

2import fs from 'fs/promises';

3import _ from 'lodash';

4import { OpenAI } from 'openai';

5import dns from 'node:dns';

6import fse from 'fs-extra';

7import { Client as SSHClient } from 'ssh2';

8import puppeteer from 'puppeteer';

9import utf8 from 'utf8';

10import os from 'os';

11import { execFile } from 'child_process';

12import { promisify } from 'util';

High

Child Process

Package source references child process execution.

index.mjsView on unpkg · L10

14await import('dotenv/config');

16global._conf = (await import(path.join(process.env.XUDA_HOME, "common", "load_conf.mjs"))).loadConf();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.mjsView on unpkg · L4

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

index.mjsView on unpkg · L4

18const _common = await import(path.join(process.env.XUDA_HOME, 'common', 'xuda_node_common.mjs'));

19const _utils = await import(path.join(process.env.XUDA_HOME, 'common', 'xuda-cpi-utils.mjs'));

21// Static catalog of advertising platforms (source of truth). Each entry carries

22// Xuda-owned credentials that are STRIPPED before ever leaving the server — see

23// get_advertise_platforms. status: 1 pending, 2 process, 3 active, 4 deleted, 5 archived.

24const advertise_platforms = (await import('./advertise_platforms.json', { with: { type: 'json' } })).default;

26const module_path = path.join(process.env.XUDA_HOME, 'cpi') + (!_conf.is_debug ? '/node_modules/@xuda.io' : '');

28const db_module = await import(`${module_path}/db_module/index.mjs`);

29const stripe_ms = await import(`${module_path}/stripe_module/index_ms.mjs`);

30const drive_ms = await import(`${module_path}/drive_module/index_ms.mjs`);

index_ms.mjsView file

Lines 1-28javascript

1// =====================================================

2// Queue wrapper – generated from index.mjs

3// Queue target : misc_module

4// =====================================================

7 import path from 'node:path';

9 const { MessageBroker } = await import(path.

Source & flagged code

5 flagged · loading source

.envView file

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: OPENAI_API_KEY=<redacted:56 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

index.mjsView file

10import os from 'os'; L11: import { execFile } from 'child_process'; L12: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

index.mjsView on unpkg · L10

4import { OpenAI } from 'openai'; L5: import dns from 'node:dns'; L6: import fse from 'fs-extra'; ... L10: import os from 'os'; L11: import { execFile } from 'child_process'; L12: import { promisify } from 'util'; ... L15: L16: global._conf = (await import(path.join(process.env.XUDA_HOME, "common", "load_conf.mjs"))).loadConf(); L17:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.mjsView on unpkg · L4

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

index.mjsView on unpkg · L4

index_ms.mjsView file

8L9: const { MessageBroker } = await import(path.join(process.env.XUDA_HOME, 'common', 'ms_broker.mjs')); L10:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index_ms.mjsView on unpkg · L8

Findings

1 Critical4 High3 Medium4 Low

CriticalCritical Secret.env

HighChild Processindex.mjs

HighShell

HighSame File Env Network Executionindex.mjs

HighCredential Exfiltrationindex.mjs

MediumDynamic Requireindex_ms.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings