api-switch-cc@0.8.0: Suspicious npm security report (Warn)

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 17.9 KB of source, external domains: gitee.com, github.com, go.dev, goproxy.cn

Source & flagged code

1 flagged

api-switch.jsView file

19const { join } = require("path"); L20: const { execSync, spawnSync } = require("child_process"); L21: L22: const PKG = require("./package.json"); L23: const VERSION = "v" + PKG.version; L24: const BIN_DIR = join(__dirname, ".bin"); L25: const IS_WIN = process.platform === "win32"; L26: const IS_MAC = process.platform === "darwin"; ... L29: L30: const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git"; L31: // Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat} ... L208: } catch (e) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19

Source & flagged code

1 flagged · loading source

api-switch.jsView file

19const { join } = require("path"); L20: const { execSync, spawnSync } = require("child_process"); L21: L22: const PKG = require("./package.json"); L23: const VERSION = "v" + PKG.version; L24: const BIN_DIR = join(__dirname, ".bin"); L25: const IS_WIN = process.platform === "win32"; L26: const IS_MAC = process.platform === "darwin"; ... L29: L30: const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git"; L31: // Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat} ... L208: } catch (e) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19

Findings

1 High1 Medium3 Low

HighSandbox Evasion Gated Capabilityapi-switch.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings