registry / ani-web / 2.1.8

ani-web@2.1.8

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 62 file(s), 990 KB of source, external domains: accounts.google.com, allanime.day, aln.youtube-anime.com, animepahe.pw, animeya.cc, aomedia.org, api.allanime.day, api.aniskip.com, api.github.com, github.com, gogoanime.lu, graphql.anilist.co, megaplay.buzz, oauth2.googleapis.com, registry.npmjs.org, s4.anilist.co, script.google.com, shirayuki-scrapper-api.onrender.com, www.googleapis.com, www.mp4upload.com, www.w3.org, youtu-chan.com

Source & flagged code

4 flagged

server/.envView file

1patternName = blocked_file severity = critical matchedText = server/.env redactedSecretContext = secretLikeLines = 1 L1: DISCORD_CLIENT_ID=<redacted:19 hex>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/.envView on unpkg · L1

server/dist/github-sync.jsView file

61]; L62: const nativeImport = new Function('specifier', 'return import(specifier)'); L63: function getGitHubClientId() {

High

Eval

Package source references dynamic code evaluation.

server/dist/github-sync.jsView on unpkg · L61

39exports.githubSyncService = void 0; L40: const logger_1 = __importDefault(require("./logger")); L41: const db_utils_1 = require("./utils/db-utils");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/github-sync.jsView on unpkg · L39

server/dist/controllers/proxy.controller.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ani-web@2.1.4 matchedIdentity = npm:YW5pLXdlYg:2.1.4 similarity = 0.855 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/controllers/proxy.controller.jsView on unpkg

Source & flagged code

4 flagged · loading source

server/.envView file

1patternName = blocked_file severity = critical matchedText = server/.env redactedSecretContext = secretLikeLines = 1 L1: DISCORD_CLIENT_ID=<redacted:19 hex>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/.envView on unpkg · L1

server/dist/github-sync.jsView file

61]; L62: const nativeImport = new Function('specifier', 'return import(specifier)'); L63: function getGitHubClientId() {

High

Eval

Package source references dynamic code evaluation.

server/dist/github-sync.jsView on unpkg · L61

39exports.githubSyncService = void 0; L40: const logger_1 = __importDefault(require("./logger")); L41: const db_utils_1 = require("./utils/db-utils");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/github-sync.jsView on unpkg · L39

Findings

1 Critical2 High5 Medium6 Low

CriticalCritical Secretserver/.env

HighEvalserver/dist/github-sync.js

HighPrevious Version Dangerous Deltaserver/dist/controllers/proxy.controller.js

MediumDynamic Requireserver/dist/github-sync.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings