codeplay-common@4.9.5

⚠ Under review

Common build scripts and files

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 480 KB of source, external domains: 127.0.0.1, api.openai.com, apps.apple.com, htmlcodeplay.com, play.google.com, schemas.android.com, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/sync-files.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

files/generate-ai-promo-video.jsView file

17const { createHash } = require('node:crypto'); L18: const { spawnSync } = require('node:child_process'); L19: const { createInterface } = require('node:readline/promises');

High

Child Process

Package source references child process execution.

files/generate-ai-promo-video.jsView on unpkg · L17

•matchType = normalized_sha256 matchedPackage = codeplay-common@4.8.1 matchedPath = files/generate-ai-promo-video.js matchedIdentity = npm:Y29kZXBsYXktY29tbW9u:4.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

files/generate-ai-promo-video.jsView on unpkg

17const { createHash } = require('node:crypto'); L18: const { spawnSync } = require('node:child_process'); L19: const { createInterface } = require('node:readline/promises'); L20: L21: const projectDirectory = __dirname; L22: const capacitorConfigPath = path.join(projectDirectory, 'capacitor.config.json'); L23: const capacitorConfig = JSON.parse(fs.readFileSync(capacitorConfigPath, 'utf8')); L24: const appName = String(capacitorConfig.appName || '').trim(); ... L41: const appFilePrefix = `${appUniqueId}. ${sanitizeFileNamePart(appName)}`; L42: const playStoreDownloadUrl = `https://play.google.com/store/apps/details?id=${encodeURIComponent(packageId)}`; L43: const configuredAppStoreUrl = String(iosStoreConfig.appStoreUrl || '') ... L88: const promoCopyResultPath = path.join(temporaryDir

Low

Weak Crypto

Package source references weak cryptographic algorithms.

files/generate-ai-promo-video.jsView on unpkg · L17

scripts/sync-files.jsView file

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/sync-files.jsView on unpkg · L1

files/buildCodeplay/codeplayBeforeBuild-6.4.jsView file

138try { L139: execSync(`npm install ${packageName}`, { stdio: "inherit" }); L140: console.log(`✅ "${packageName}" installed successfully.`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

files/buildCodeplay/codeplayBeforeBuild-6.4.jsView on unpkg · L138

files/buildCodeplay/setSplashAnimation-1.4.jsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

files/buildCodeplay/setSplashAnimation-1.4.jsView on unpkg

files/iap-install-2.jsView file

•matchType = normalized_sha256 matchedPackage = codeplay-common@4.8.1 matchedPath = files/iap-install-2.js matchedIdentity = npm:Y29kZXBsYXktY29tbW9u:4.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

files/iap-install-2.jsView on unpkg

files/buildCodeplay/manifestModification.jsView file

•matchType = normalized_sha256 matchedPackage = codeplay-common@4.8.1 matchedPath = [redacted].js matchedIdentity = npm:Y29kZXBsYXktY29tbW9u:4.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

files/buildCodeplay/manifestModification.jsView on unpkg

files/scripts/screenshot/frame-samples.jsView file

•matchType = normalized_sha256 matchedPackage = codeplay-common@4.8.1 matchedPath = files/scripts-screenshot/screenshot/frame-samples.js matchedIdentity = npm:Y29kZXBsYXktY29tbW9u:4.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

files/scripts/screenshot/frame-samples.jsView on unpkg

files/scripts/setup-baseline-profile.jsView file

•matchType = normalized_sha256 matchedPackage = codeplay-common@4.8.1 matchedPath = files/scripts/setup-baseline-profile.js matchedIdentity = npm:Y29kZXBsYXktY29tbW9u:4.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

files/scripts/setup-baseline-profile.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/sync-files.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

files/generate-ai-promo-video.jsView file

17const { createHash } = require('node:crypto'); L18: const { spawnSync } = require('node:child_process'); L19: const { createInterface } = require('node:readline/promises');

High

Child Process

Package source references child process execution.

files/generate-ai-promo-video.jsView on unpkg · L17

High

Known Malware Source Similarity

Findings

10 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processfiles/generate-ai-promo-video.js

HighShell

HighRuntime Package Installfiles/buildCodeplay/codeplayBeforeBuild-6.4.js

HighSemantic Analysis Limitedfiles/buildCodeplay/setSplashAnimation-1.4.js

HighKnown Malware Source Similarityfiles/generate-ai-promo-video.js

HighKnown Malware Source Similarityfiles/iap-install-2.js

HighKnown Malware Source Similarityfiles/buildCodeplay/manifestModification.js

HighKnown Malware Source Similarityfiles/scripts/screenshot/frame-samples.js

HighKnown Malware Source Similarityfiles/scripts/setup-baseline-profile.js

MediumDynamic Require

Affected versions and remediation

This report applies to codeplay-common@4.9.5.

See all versions of codeplay-common for other recorded verdicts.

Review the evidence and your use of codeplay-common@4.9.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 05:11:16.065Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.