registry / @yoooclaw/phone-notifications / 1.14.1
@yoooclaw/phone-notifications@1.14.1
⚠ Under review后台同步手机通知数据到本地存储，供 Agent 查询消费
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/bin/ntf.cjsView file
785var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
L787: var path = require("node:path");
High
67class CommanderError extends Error {
L68: constructor(exitCode, code, message) {
L69: super(message);
...
L785: var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
L787: var path = require("node:path");
...
L831: this._outputConfiguration = {
L832: writeOut: (str) => process2.stdout.write(str),
L833: writeErr: (str) => process2.stderr.write(str),
...
L2190: }
L2191: function homeDir() {
L2192: return process.env.HOME || process.env.USERPROFILE || "/tmp";
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/bin/ntf.cjsView on unpkg · L67784var require_command = __commonJS((exports2) => {
L785: var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
Findings
3 High4 Medium6 Low
HighChild Processdist/bin/ntf.cjs
HighCredential Redirect Persistencedist/index.cjs
HighCommand Output Exfiltrationdist/bin/ntf.cjs
MediumDynamic Requiredist/bin/ntf.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @yoooclaw/phone-notifications@1.14.1.
See all versions of @yoooclaw/phone-notifications for other recorded verdicts.
- Review the evidence and your use of @yoooclaw/phone-notifications@1.14.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.