registry  /  @zyno-io/ts-server-foundation  /  26.711.2132

@zyno-io/ts-server-foundation@26.711.2132

Static Scan Results

scanned 15h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 181 file(s), 7.80 MB of source, external domains: spec.openapis.org

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/src/auth/jwt.jsView file
339patternName = private_key_rsa severity = critical line = 339 matchedText = return `...--`;
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/src/auth/jwt.jsView on unpkg · L339
339patternName = private_key_rsa severity = critical line = 339 matchedText = return `...--`;
Critical
Secret Pattern

RSA private key in dist/src/auth/jwt.js

dist/src/auth/jwt.jsView on unpkg · L339
dist/src/database/migration/index.jsView file
16tslib_1.__exportStar(require("./maintenance"), exports); L17: const dynamicImport = new Function('specifier', 'return import(specifier)'); L18: function createMigration(fn) {
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/src/database/migration/index.jsView on unpkg · L16
dist/src/database/database.jsView file
7exports.logSql = logSql; L8: const node_async_hooks_1 = require("node:async_hooks"); L9: const reflection_1 = require("../reflection");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/src/database/database.jsView on unpkg · L7

Findings

2 Critical1 High5 Medium6 Low
CriticalCritical Secretdist/src/auth/jwt.js
CriticalSecret Patterndist/src/auth/jwt.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/database/database.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/src/database/migration/index.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings