registry  /  @xxz_cocoscreator/framework-src  /  1.0.3

@xxz_cocoscreator/framework-src@1.0.3

Cocos Creator 框架核心层（逻辑 + 基类 + bootstrap），随包发全局类型声明

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
EnvironmentVarsFilesystemNetworkWebSocket
Supply chain
HighEntropyStringsMinified
Manifest
NoLicense
scanned 2 file(s), 208 KB of source

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/index.jsView file
8*/ L9: const a0aS=a0b;(function(a,c){const aR=a0b,d=a();while(!![]){try{const f=parseInt(aR(0x468))/0x1+-parseInt(aR(0x69d))/0x2+parseInt(aR(0x2f3))/0x3+parseInt(aR(0x3d1))/0x4*(-parseInt...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L8

Findings

2 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighObfuscated Payload Loaderdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License