registry / atatus-nodejs / 3.5.3

atatus-nodejs@3.5.3

Atatus APM agent for Node.js

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 168 file(s), 950 KB of source, external domains: 169.254.169.254, an-rx.atatus.com, apm-rx.atatus.com, dt-rx.atatus.com, github.com, log-rx.atatus.com, metadata.google.internal

Source & flagged code

2 flagged

start.jsView file

Lines 1-30javascript

1/*

2 * Copyright Elasticsearch B.V. and other contributors where applicable.

3 * Licensed under the BSD 2-Clause License; you may not use this file except in

4 * compliance with the BSD 2-Clause License.

5 */

7'use strict';

9// Load and start the APM agent.

10//

11// Note: Currently this will *not* start the agent in Worker threads because

12// that is arguably not desired default behavior when using:

13// node --require=atatus-nodejs/start.js ...

15const apm = require('./');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.jsView on unpkg · L14

17var isMainThread;

18try {

19 var workerThreads = require('worker_threads');

20 isMainThread = workerThreads.isMainThread;

21} catch (_importErr) {

22 // worker_threads were added in node 12 and behind a flag in node ^10.5.0.

23 isMainThread = true;

24}

25if (isMainThread) {

26 apm.start();

27}

29module.exports = apm;

lib/cloud-metadata/azure.jsView file

Lines 1-30javascript

1/*

2 * Copyright Elasticsearch B.V. and other contributors where applicable.

3 * Licensed under the BSD 2-Clause License; you may not use this file except in

4 * compliance with the BSD 2-Clause License.

5 */

7'use strict';

8const URL = require('url').URL;

9const {

Source & flagged code

2 flagged · loading source

start.jsView file

14L15: const apm = require('./'); L16:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.jsView on unpkg · L14

lib/cloud-metadata/azure.jsView file

10L11: const DEFAULT_BASE_URL = new URL('/', 'http://169.254.169.254:80'); L12: ... L37: headers: { L38: Metadata: 'true', L39: }, ... L106: }; L107: const parsed = JSON.parse(string); L108: if (!parsed.compute) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/cloud-metadata/azure.jsView on unpkg · L10

Findings

1 High4 Medium5 Low

HighCloud Metadata Accesslib/cloud-metadata/azure.js

MediumDynamic Requirestart.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

start.jsView file

Lines 1-30javascript

1/*

2 * Copyright Elasticsearch B.V. and other contributors where applicable.

3 * Licensed under the BSD 2-Clause License; you may not use this file except in

4 * compliance with the BSD 2-Clause License.

5 */

7'use strict';

9// Load and start the APM agent.

10//

11// Note: Currently this will *not* start the agent in Worker threads because

12// that is arguably not desired default behavior when using:

13// node --require=atatus-nodejs/start.js ...

15const apm = require('./');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.jsView on unpkg · L14

17var isMainThread;

18try {

19 var workerThreads = require('worker_threads');

20 isMainThread = workerThreads.isMainThread;

21} catch (_importErr) {

22 // worker_threads were added in node 12 and behind a flag in node ^10.5.0.

23 isMainThread = true;

24}

25if (isMainThread) {

26 apm.start();

27}

29module.exports = apm;

lib/cloud-metadata/azure.jsView file

Lines 1-30javascript

1/*

2 * Copyright Elasticsearch B.V. and other contributors where applicable.

3 * Licensed under the BSD 2-Clause License; you may not use this file except in

4 * compliance with the BSD 2-Clause License.

5 */

7'use strict';

8const URL = require('url').URL;

9const {