@zuplo/runtime: Suspicious npm security report (Warn)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 10 file(s), 1.34 MB of source, external domains: accounts.google.com, aisec.akamai.com, api.anthropic.com, api.datadoghq.com, api.example.com, api.galileo.ai, api.mistral.ai, api.moesif.net, api.openai.com, api.x.ai, api.zuplo.com, api.zuploedge.com, apikey.zuploedge.com, app.amberflo.io, build-assets.zuplo.com, cdn.jsdelivr.net, cdn.zuplo.com, dev-portal-v4-1.zuplo.com, dev.zuplo.com, ellie.zuploedge.com, fga.us.auth0.com, generativelanguage.googleapis.com, http-intake.logs.datadoghq.com, httpproblems.com, iam.googleapis.com, iamcredentials.googleapis.com, identitytoolkit.googleapis.com, json-schema.org, logging.googleapis.com, login.microsoftonline.com, meters.zuploedge.com, metric-api.newrelic.com, metrics.readme.io, openmeter.cloud, redis-proxy.zuploedge.com, streaming-zone-cache.zuplo.app, sts.googleapis.com, tools.ietf.org, www.googleapis.com, www.w3.org, yarnpkg.com, zone-cache.zuplo.app, zup.fail, zuplo.com

Source & flagged code

2 flagged

out/esm/chunk-NIKKAYJU.jsView file

24L25: import{d as je,f as Xl,g as ed}from"./chunk-4MNJC7E2.js";import{a as X,b as ZR}from"./chunk-4QJJMELB.js";import{a as lo,c as Ne,d as mt,e as de,f as po,g as Ci,h as Le,i as Da,j as... L26: `)}var ax,as,Uo,Ip=Y(()=>{Lo();ve();ax=s((t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerabl... L27: `).filter(a=>a),r=Math.min(...o.map(a=>a.length-a.trimStart().length)),i=o.map(a=>a.slice(r)).map(a=>" ".repeat(this.indent*2)+a);for(let a of i)this.content.push(a)}compile(){let ... L28: `))}}});var vm,Rm=Y(()=>{vm={major:4,minor:0,patch:0}});function Zm(t){if(t==="")return!0;if(t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function Px(t){if(!Gc.tes... L29: if (${x}.issues.length) { ... L57: `).filter(p=>p.startsWith("data:")).map(p=>p.slice(5).trim());if(n.length===0)return null;let o=n.join(` L58: `);if(o==="[DONE]")return{raw:"[DONE]",done:!0};let r;try{r=JSON.parse(o)}catch{return{raw:o}}let i=r,a=e==="openai-responses"?i?.response:e==="anthropic-messages"?i?.message:void ... L59: `).filter(e=>!e.trim().startsWith("at async file")).map((e,n)=>{let o=e.replaceAll(I0,"").replaceAl

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/esm/chunk-NIKKAYJU.jsView on unpkg · L24

64`?"\\n":"\\r"),c.singleQuotes===!1?(a=a.replace(/"/g,'\\"'),`"${a}"`):(a=a.replace(/'/g,"\\'"),`'${a}'`)}),"stringify")(t,e,n,0)}s(Fa,"stringifyObject");function Vt(t){return cS(Lr... L65: `)}s(aS,"messagesToMultilineText");function cS(t){return typeof t=="string"?t:JSON.stringify(t)}s(cS,"stringifyNonString");function Ga(t){return typeof t=="string"?t:t===null?"null... L66: <!DOCTYPE html>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/esm/chunk-NIKKAYJU.jsView on unpkg · L64

Source & flagged code

2 flagged · loading source

out/esm/chunk-NIKKAYJU.jsView file

24L25: import{d as je,f as Xl,g as ed}from"./chunk-4MNJC7E2.js";import{a as X,b as ZR}from"./chunk-4QJJMELB.js";import{a as lo,c as Ne,d as mt,e as de,f as po,g as Ci,h as Le,i as Da,j as... L26: `)}var ax,as,Uo,Ip=Y(()=>{Lo();ve();ax=s((t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerabl... L27: `).filter(a=>a),r=Math.min(...o.map(a=>a.length-a.trimStart().length)),i=o.map(a=>a.slice(r)).map(a=>" ".repeat(this.indent*2)+a);for(let a of i)this.content.push(a)}compile(){let ... L28: `))}}});var vm,Rm=Y(()=>{vm={major:4,minor:0,patch:0}});function Zm(t){if(t==="")return!0;if(t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function Px(t){if(!Gc.tes... L29: if (${x}.issues.length) { ... L57: `).filter(p=>p.startsWith("data:")).map(p=>p.slice(5).trim());if(n.length===0)return null;let o=n.join(` L58: `);if(o==="[DONE]")return{raw:"[DONE]",done:!0};let r;try{r=JSON.parse(o)}catch{return{raw:o}}let i=r,a=e==="openai-responses"?i?.response:e==="anthropic-messages"?i?.message:void ... L59: `).filter(e=>!e.trim().startsWith("at async file")).map((e,n)=>{let o=e.replaceAll(I0,"").replaceAl

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/esm/chunk-NIKKAYJU.jsView on unpkg · L24

64`?"\\n":"\\r"),c.singleQuotes===!1?(a=a.replace(/"/g,'\\"'),`"${a}"`):(a=a.replace(/'/g,"\\'"),`'${a}'`)}),"stringify")(t,e,n,0)}s(Fa,"stringifyObject");function Vt(t){return cS(Lr... L65: `)}s(aS,"messagesToMultilineText");function cS(t){return typeof t=="string"?t:JSON.stringify(t)}s(cS,"stringifyNonString");function Ga(t){return typeof t=="string"?t:t===null?"null... L66: <!DOCTYPE html>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/esm/chunk-NIKKAYJU.jsView on unpkg · L64

Findings

1 High4 Medium4 Low

HighCloud Metadata Accessout/esm/chunk-NIKKAYJU.js

MediumDynamic Requireout/esm/chunk-NIKKAYJU.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License