@zuplo/runtime@6.72.15

This module contains the type definitions for the Zuplo Runtime.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 10 file(s), 1.35 MB of source, external domains: accounts.google.com, aisec.akamai.com, api.anthropic.com, api.datadoghq.com, api.example.com, api.galileo.ai, api.mistral.ai, api.moesif.net, api.openai.com, api.x.ai, api.zuplo.com, api.zuploedge.com, apikey.zuploedge.com, app.amberflo.io, build-assets.zuplo.com, cdn.jsdelivr.net, cdn.zuplo.com, dev-portal-v4-1.zuplo.com, dev.zuplo.com, ellie.zuploedge.com, example.com, fga.us.auth0.com, generativelanguage.googleapis.com, http-intake.logs.datadoghq.com, httpproblems.com, iam.googleapis.com, iamcredentials.googleapis.com, identitytoolkit.googleapis.com, json-schema.org, logging.googleapis.com, login.microsoftonline.com, meters.zuploedge.com, metric-api.newrelic.com, metrics.readme.io, openmeter.cloud, redis-proxy.zuploedge.com, streaming-zone-cache.zuplo.app, sts.googleapis.com, tools.ietf.org, www.googleapis.com, www.w3.org, yarnpkg.com, zone-cache.zuplo.app, zup.fail, zuplo.com

Source & flagged code

2 flagged

out/esm/chunk-SQVIQSIN.jsView file

24L25: import{c as qe,f as pd,g as md}from"./chunk-32F3RZS4.js";import{a as te,b as uS}from"./chunk-4QJJMELB.js";import{a as de,b as Di,c as Ne,d as bo,f as De,g as mt,h as wo,i as Ga,j a... L26: `)}var xx,fs,Vo,jp=ee(()=>{Fo();ve();xx=s((t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerab... L27: `).filter(a=>a),r=Math.min(...o.map(a=>a.length-a.trimStart().length)),i=o.map(a=>a.slice(r)).map(a=>" ".repeat(this.indent*2)+a);for(let a of i)this.content.push(a)}compile(){let ... L28: `))}}});var Dm,Um=ee(()=>{Dm={major:4,minor:0,patch:0}});function sf(t){if(t==="")return!0;if(t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function Hx(t){if(!Qc.te... L29: if (${x}.issues.length) { ... L57: `).filter(p=>p.startsWith("data:")).map(p=>p.slice(5).trim());if(n.length===0)return null;let o=n.join(` L58: `);if(o==="[DONE]")return{raw:"[DONE]",done:!0};let r;try{r=JSON.parse(o)}catch{return{raw:o}}let i=r,a=e==="openai-responses"?i?.response:e==="anthropic-messages"?i?.message:void ... L59: `).filter(e=>!e.trim().startsWith("at async file")).map((e,n)=>{let o=e.replaceAll(G0,"").replaceAl

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/esm/chunk-SQVIQSIN.jsView on unpkg · L24

64`?"\\n":"\\r"),c.singleQuotes===!1?(a=a.replace(/"/g,'\\"'),`"${a}"`):(a=a.replace(/'/g,"\\'"),`'${a}'`)}),"stringify")(t,e,n,0)}s(Ya,"stringifyObject");function Kt(t){return DS(Zr... L65: `)}s(NS,"messagesToMultilineText");function DS(t){return typeof t=="string"?t:JSON.stringify(t)}s(DS,"stringifyNonString");function Qa(t){return typeof t=="string"?t:t===null?"null... L66: <!DOCTYPE html>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/esm/chunk-SQVIQSIN.jsView on unpkg · L64

Source & flagged code

2 flagged · loading source

out/esm/chunk-SQVIQSIN.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/esm/chunk-SQVIQSIN.jsView on unpkg · L24

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/esm/chunk-SQVIQSIN.jsView on unpkg · L64

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code