@zuplo/runtime@6.72.1: Suspicious npm security report (Warn)

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 8 file(s), 1.32 MB of source, external domains: aisec.akamai.com, api.anthropic.com, api.datadoghq.com, api.example.com, api.galileo.ai, api.mistral.ai, api.moesif.net, api.openai.com, api.x.ai, api.zuplo.com, api.zuploedge.com, apikey.zuploedge.com, app.amberflo.io, build-assets.zuplo.com, cdn.jsdelivr.net, cdn.zuplo.com, dev-portal-v4-1.zuplo.com, dev.zuplo.com, ellie.zuploedge.com, fga.us.auth0.com, generativelanguage.googleapis.com, http-intake.logs.datadoghq.com, httpproblems.com, iamcredentials.googleapis.com, json-schema.org, logging.googleapis.com, meters.zuploedge.com, metric-api.newrelic.com, metrics.readme.io, openmeter.cloud, redis-proxy.zuploedge.com, streaming-zone-cache.zuplo.app, sts.googleapis.com, tools.ietf.org, www.googleapis.com, www.w3.org, yarnpkg.com, zone-cache.zuplo.app, zup.fail, zuplo.com

Source & flagged code

2 flagged

out/esm/chunk-IC7XGD5C.jsView file

24L25: import{d as Xe,f as Kd,g as Yd}from"./chunk-4MNJC7E2.js";import{a as te,b as Zx}from"./chunk-4QJJMELB.js";import{$ as Oe,A as kc,B as Pc,C as Ac,D as Ix,E as Tx,F as _x,G as Cx,H a... L26: `)}var sT,sa,Di,Tm=Q(()=>{Ni();_e();sT=s((t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerabl... L27: `).filter(a=>a),r=Math.min(...o.map(a=>a.length-a.trimStart().length)),i=o.map(a=>a.slice(r)).map(a=>" ".repeat(this.indent*2)+a);for(let a of i)this.content.push(a)}compile(){let ... L28: `))}}});var Sf,If=Q(()=>{Sf={major:4,minor:0,patch:0}});function Gf(t){if(t==="")return!0;if(t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function TT(t){if(!Bu.tes... L29: if (${I}.issues.length) { ... L57: `).filter(p=>p.startsWith("data:")).map(p=>p.slice(5).trim());if(n.length===0)return null;let o=n.join(` L58: `);if(o==="[DONE]")return{raw:"[DONE]",done:!0};let r;try{r=JSON.parse(o)}catch{return{raw:o}}let i=r,a=e==="openai-responses"?i?.response:e==="anthropic-messages"?i?.message:void ... L59: `).filter(e=>!e.trim().startsWith("at async file")).map((e,n)=>{let o=e.replaceAll(vN,"").replaceAl

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/esm/chunk-IC7XGD5C.jsView on unpkg · L24

64`?"\\n":"\\r"),c.singleQuotes===!1?(a=a.replace(/"/g,'\\"'),`"${a}"`):(a=a.replace(/'/g,"\\'"),`'${a}'`)}),"stringify")(t,e,n,0)}s(Zc,"stringifyObject");function an(t){return iS(uo... L65: `)}s(oS,"messagesToMultilineText");function iS(t){return typeof t=="string"?t:JSON.stringify(t)}s(iS,"stringifyNonString");function Hc(t){return typeof t=="string"?t:t===null?"null... L66: <!DOCTYPE html>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/esm/chunk-IC7XGD5C.jsView on unpkg · L64

Source & flagged code

2 flagged · loading source

out/esm/chunk-IC7XGD5C.jsView file

24L25: import{d as Xe,f as Kd,g as Yd}from"./chunk-4MNJC7E2.js";import{a as te,b as Zx}from"./chunk-4QJJMELB.js";import{$ as Oe,A as kc,B as Pc,C as Ac,D as Ix,E as Tx,F as _x,G as Cx,H a... L26: `)}var sT,sa,Di,Tm=Q(()=>{Ni();_e();sT=s((t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerabl... L27: `).filter(a=>a),r=Math.min(...o.map(a=>a.length-a.trimStart().length)),i=o.map(a=>a.slice(r)).map(a=>" ".repeat(this.indent*2)+a);for(let a of i)this.content.push(a)}compile(){let ... L28: `))}}});var Sf,If=Q(()=>{Sf={major:4,minor:0,patch:0}});function Gf(t){if(t==="")return!0;if(t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function TT(t){if(!Bu.tes... L29: if (${I}.issues.length) { ... L57: `).filter(p=>p.startsWith("data:")).map(p=>p.slice(5).trim());if(n.length===0)return null;let o=n.join(` L58: `);if(o==="[DONE]")return{raw:"[DONE]",done:!0};let r;try{r=JSON.parse(o)}catch{return{raw:o}}let i=r,a=e==="openai-responses"?i?.response:e==="anthropic-messages"?i?.message:void ... L59: `).filter(e=>!e.trim().startsWith("at async file")).map((e,n)=>{let o=e.replaceAll(vN,"").replaceAl

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/esm/chunk-IC7XGD5C.jsView on unpkg · L24

64`?"\\n":"\\r"),c.singleQuotes===!1?(a=a.replace(/"/g,'\\"'),`"${a}"`):(a=a.replace(/'/g,"\\'"),`'${a}'`)}),"stringify")(t,e,n,0)}s(Zc,"stringifyObject");function an(t){return iS(uo... L65: `)}s(oS,"messagesToMultilineText");function iS(t){return typeof t=="string"?t:JSON.stringify(t)}s(iS,"stringifyNonString");function Hc(t){return typeof t=="string"?t:t===null?"null... L66: <!DOCTYPE html>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/esm/chunk-IC7XGD5C.jsView on unpkg · L64

Findings

1 High4 Medium4 Low

HighCloud Metadata Accessout/esm/chunk-IC7XGD5C.js

MediumDynamic Requireout/esm/chunk-IC7XGD5C.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License