@zuplo/runtime@6.71.22: Suspicious npm security report (Warn)

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 8 file(s), 1.29 MB of source, external domains: aisec.akamai.com, api.anthropic.com, api.datadoghq.com, api.example.com, api.galileo.ai, api.mistral.ai, api.moesif.net, api.openai.com, api.x.ai, api.zuplo.com, api.zuploedge.com, apikey.zuploedge.com, app.amberflo.io, build-assets.zuplo.com, cdn.jsdelivr.net, cdn.zuplo.com, dev-portal-v4-1.zuplo.com, dev.zuplo.com, ellie.zuploedge.com, fga.us.auth0.com, generativelanguage.googleapis.com, http-intake.logs.datadoghq.com, httpproblems.com, iamcredentials.googleapis.com, json-schema.org, logging.googleapis.com, meters.zuploedge.com, metric-api.newrelic.com, metrics.readme.io, openmeter.cloud, redis-proxy.zuploedge.com, streaming-zone-cache.zuplo.app, sts.googleapis.com, tools.ietf.org, www.googleapis.com, www.w3.org, yarnpkg.com, zone-cache.zuplo.app, zup.fail, zuplo.com

Source & flagged code

2 flagged

out/esm/chunk-36XLJ4X6.jsView file

24L25: import{d as nt,f as Ud,g as zd}from"./chunk-4MNJC7E2.js";import{a as ee,b as wx}from"./chunk-54PA7VDV.js";import{$ as Ee,A as bc,B as vc,C as wc,D as nx,E as rx,F as ox,G as ix,H a... L26: `)}var $I,Xs,Ei,dm=Y(()=>{Ci();Ie();$I=s((t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerabl... L27: `).filter(a=>a),r=Math.min(...o.map(a=>a.length-a.trimStart().length)),i=o.map(a=>a.slice(r)).map(a=>" ".repeat(this.indent*2)+a);for(let a of i)this.content.push(a)}compile(){let ... L28: `))}}});var uf,lf=Y(()=>{uf={major:4,minor:0,patch:0}});function Ef(t){if(t==="")return!0;if(t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function QI(t){if(!$u.tes... L29: if (${T}.issues.length) { ... L57: `).filter(p=>p.startsWith("data:")).map(p=>p.slice(5).trim());if(n.length===0)return null;let o=n.join(` L58: `);if(o==="[DONE]")return{raw:"[DONE]",done:!0};let r;try{r=JSON.parse(o)}catch{return{raw:o}}let i=r,a=e==="openai-responses"?i?.response:e==="anthropic-messages"?i?.message:void ... L59: `).filter(e=>!e.trim().startsWith("at async file")).map((e,n)=>{let o=e.replaceAll(h$,"").replaceAl

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/esm/chunk-36XLJ4X6.jsView on unpkg · L24

64`?"\\n":"\\r"),c.singleQuotes===!1?(a=a.replace(/"/g,'\\"'),`"${a}"`):(a=a.replace(/'/g,"\\'"),`'${a}'`)}),"stringify")(t,e,n,0)}s(Ec,"stringifyObject");function Qt(t){return Dx(oo... L65: `)}s(Lx,"messagesToMultilineText");function Dx(t){return typeof t=="string"?t:JSON.stringify(t)}s(Dx,"stringifyNonString");function Oc(t){return typeof t=="string"?t:t===null?"null... L66: <!DOCTYPE html>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/esm/chunk-36XLJ4X6.jsView on unpkg · L64

Source & flagged code

2 flagged · loading source

out/esm/chunk-36XLJ4X6.jsView file

24L25: import{d as nt,f as Ud,g as zd}from"./chunk-4MNJC7E2.js";import{a as ee,b as wx}from"./chunk-54PA7VDV.js";import{$ as Ee,A as bc,B as vc,C as wc,D as nx,E as rx,F as ox,G as ix,H a... L26: `)}var $I,Xs,Ei,dm=Y(()=>{Ci();Ie();$I=s((t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerabl... L27: `).filter(a=>a),r=Math.min(...o.map(a=>a.length-a.trimStart().length)),i=o.map(a=>a.slice(r)).map(a=>" ".repeat(this.indent*2)+a);for(let a of i)this.content.push(a)}compile(){let ... L28: `))}}});var uf,lf=Y(()=>{uf={major:4,minor:0,patch:0}});function Ef(t){if(t==="")return!0;if(t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function QI(t){if(!$u.tes... L29: if (${T}.issues.length) { ... L57: `).filter(p=>p.startsWith("data:")).map(p=>p.slice(5).trim());if(n.length===0)return null;let o=n.join(` L58: `);if(o==="[DONE]")return{raw:"[DONE]",done:!0};let r;try{r=JSON.parse(o)}catch{return{raw:o}}let i=r,a=e==="openai-responses"?i?.response:e==="anthropic-messages"?i?.message:void ... L59: `).filter(e=>!e.trim().startsWith("at async file")).map((e,n)=>{let o=e.replaceAll(h$,"").replaceAl

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/esm/chunk-36XLJ4X6.jsView on unpkg · L24

64`?"\\n":"\\r"),c.singleQuotes===!1?(a=a.replace(/"/g,'\\"'),`"${a}"`):(a=a.replace(/'/g,"\\'"),`'${a}'`)}),"stringify")(t,e,n,0)}s(Ec,"stringifyObject");function Qt(t){return Dx(oo... L65: `)}s(Lx,"messagesToMultilineText");function Dx(t){return typeof t=="string"?t:JSON.stringify(t)}s(Dx,"stringifyNonString");function Oc(t){return typeof t=="string"?t:t===null?"null... L66: <!DOCTYPE html>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/esm/chunk-36XLJ4X6.jsView on unpkg · L64

Findings

1 High4 Medium4 Low

HighCloud Metadata Accessout/esm/chunk-36XLJ4X6.js

MediumDynamic Requireout/esm/chunk-36XLJ4X6.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License