registry / coderaft / 0.0.36

coderaft@0.0.36

[![npm version](https://img.shields.io/npm/v/coderaft?color=blue)](https://npmx.dev/package/coderaft) [![install size](https://packagephobia.com/badge?p=coderaft)](https://packagephobia.com/result?p=coderaft)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 10 file(s), 74.7 KB of source, external domains: 127.0.0.1

Source & flagged code

7 flagged

dist/_chunks/server.mjsView file

Lines 1-40javascript

1import { createProxyServer } from "./libs/httpxy.mjs";

2import { createRequire } from "node:module";

3import { fileURLToPath, pathToFileURL } from "node:url";

4import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs";

5import { fork } from "node:child_process";

6import { randomBytes, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/_chunks/server.mjsView on unpkg · L4

7import { createServer } from "node:http";

8import { extname, join, normalize, sep } from "node:path";

9import { stat } from "node:fs/promises";

10import { loadCode } from "#code";

11var __defProp = Object.defineProperty;

12var __exportAll = (all, no_symbols) => {

13 let target = {};

14 for (var name in all) __defProp(target, name, {

15 get: all[name],

16 enumerable: true

17 });

18 if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });

19 return target;

20};

21var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();

22if (process.platform === "android") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/server.mjsView on unpkg · L20

23 if (process.execPath.includes("linker64") || process.execPath.startsWith("/apex/")) {

24 const resolved = process.env.TERMUX_EXEC__PROC_SELF_EXE || "/data/data/com.termux/files/usr/bin/node";

25 Object.defineProperty(process, "execPath", {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/_chunks/server.mjsView on unpkg · L4

26 value: resolved,

27 writable: true,

28 configurable: true,

29 enumerable: true

30 });

31 }

32 const preload = `--require "${fileURLToPath(import.meta.resolve("#android-preload"))}"`;

33 process.env.NODE_OPTIONS = process.env.NODE_OPTIONS ? `${process.env.NODE_OPTIONS} ${preload}` : preload;

34 const _fs = process.getBuiltinModule?.("fs") ?? __require("node:fs");

35 const { syncBuiltinESMExports: _syncESM } = process.getBuiltinModule?.("module") ?? __require("node:module");

36 const TERMUX_EXEC_LIB = "/data/data/com.termux/files/usr/lib/libtermux-exec.so";

37 try {

38 _fs.accessSync(TERMUX_EXEC_LIB);

39 const _cp = process.getBuiltinModule?.("child_process") ?? __require("node:child_process");

40 const _injectLdPreload = (opts) => {

dist/index.mjsView file

Lines 67-107javascript

67 #attachListeners(proc) {

68 const onExit = (code, signal) => this.emit("exit", code, signal);

69 const onError = (err) => this.emit("error"

code.tar.zstView file

•path = code.tar.zst kind = high_entropy_blob sizeBytes = 25850648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

code.tar.zstView on unpkg

•path = code.tar.zst kind = compressed_blob sizeBytes = 25850648 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

code.tar.zstView on unpkg

package.jsonView file

Lines 10-50json

10 "LICENSE.md",

11 "ThirdPartyNotices.txt",

12 "tar.mjs",

13 "code.mjs",

14 "worker.mjs",

15 "install.mjs",

16 "android-preload.cjs",

17 "code.tar.zst"

18 ],

Source & flagged code

7 flagged · loading source

dist/_chunks/server.mjsView file

4import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs"; L5: import { fork } from "node:child_process"; L6: import { randomBytes, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/_chunks/server.mjsView on unpkg · L4

4Cross-file remote execution chain: dist/_chunks/server.mjs spawns dist/_chunks/libs/httpxy.mjs; helper contains network access plus dynamic code execution. L4: import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs"; L5: import { fork } from "node:child_process"; L6: import { randomBytes, randomUUID } from "node:crypto"; L7: import { createServer } from "node:http"; L8: import { extname, join, normalize, sep } from "node:path"; ... L21: var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))(); L22: if (process.platform === "android") { L23: if (process.execPath.includes("linker64") || process.execPath.startsWith("/apex/")) { L24: const resolved = process.env.TERMUX_EXEC__PROC_SELF_EXE || "/data/data/com.termux/files/usr/bin/node"; L25: Object.defineProperty(process, "execPath", { ... L78: ]); L79: const original = _os.networkInterfaces;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/_chunks/server.mjsView on unpkg · L4

20}; L21: var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))(); L22: if (process.platform === "android") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/server.mjsView on unpkg · L20

dist/index.mjsView file

87const { spawn: spawnOpts = {}, ...serverOpts } = opts; L88: const { env, execArgv, stdio = "inherit", startupTimeout = 6e4 } = spawnOpts; L89: const workerPath = fileURLToPath(import.meta.resolve("#worker"));

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L87

code.tar.zstView file

•path = code.tar.zst kind = high_entropy_blob sizeBytes = 25850648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

code.tar.zstView on unpkg

•path = code.tar.zst kind = compressed_blob sizeBytes = 25850648 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

code.tar.zstView on unpkg

package.jsonView file

•Remote tarball dependency specs: code-server@https://github.com/coder/code-server/releases/download/v4.128.0/package.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Findings

4 High6 Medium4 Low

HighChild Processdist/_chunks/server.mjs

HighShelldist/index.mjs

HighCross File Remote Execution Contextdist/_chunks/server.mjs

HighShips High Entropy Blobcode.tar.zst

MediumDynamic Requiredist/_chunks/server.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobcode.tar.zst

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/_chunks/server.mjsView file

Lines 1-40javascript

1import { createProxyServer } from "./libs/httpxy.mjs";

2import { createRequire } from "node:module";

3import { fileURLToPath, pathToFileURL } from "node:url";

4import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs";

5import { fork } from "node:child_process";

6import { randomBytes, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/_chunks/server.mjsView on unpkg · L4

7import { createServer } from "node:http";

8import { extname, join, normalize, sep } from "node:path";

9import { stat } from "node:fs/promises";

10import { loadCode } from "#code";

11var __defProp = Object.defineProperty;

12var __exportAll = (all, no_symbols) => {

13 let target = {};

14 for (var name in all) __defProp(target, name, {

15 get: all[name],

16 enumerable: true

17 });

18 if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });

19 return target;

20};

21var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();

22if (process.platform === "android") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/server.mjsView on unpkg · L20

23 if (process.execPath.includes("linker64") || process.execPath.startsWith("/apex/")) {

24 const resolved = process.env.TERMUX_EXEC__PROC_SELF_EXE || "/data/data/com.termux/files/usr/bin/node";

25 Object.defineProperty(process, "execPath", {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/_chunks/server.mjsView on unpkg · L4

26 value: resolved,

27 writable: true,

28 configurable: true,

29 enumerable: true

30 });

31 }

32 const preload = `--require "${fileURLToPath(import.meta.resolve("#android-preload"))}"`;

33 process.env.NODE_OPTIONS = process.env.NODE_OPTIONS ? `${process.env.NODE_OPTIONS} ${preload}` : preload;

34 const _fs = process.getBuiltinModule?.("fs") ?? __require("node:fs");

35 const { syncBuiltinESMExports: _syncESM } = process.getBuiltinModule?.("module") ?? __require("node:module");

36 const TERMUX_EXEC_LIB = "/data/data/com.termux/files/usr/lib/libtermux-exec.so";

37 try {

38 _fs.accessSync(TERMUX_EXEC_LIB);

39 const _cp = process.getBuiltinModule?.("child_process") ?? __require("node:child_process");

40 const _injectLdPreload = (opts) => {

dist/index.mjsView file

Lines 67-107javascript

67 #attachListeners(proc) {

68 const onExit = (code, signal) => this.emit("exit", code, signal);

69 const onError = (err) => this.emit("error"

code.tar.zstView file

•path = code.tar.zst kind = high_entropy_blob sizeBytes = 25850648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

code.tar.zstView on unpkg

•path = code.tar.zst kind = compressed_blob sizeBytes = 25850648 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

code.tar.zstView on unpkg

package.jsonView file

Lines 10-50json

10 "LICENSE.md",

11 "ThirdPartyNotices.txt",

12 "tar.mjs",

13 "code.mjs",

14 "worker.mjs",

15 "install.mjs",

16 "android-preload.cjs",

17 "code.tar.zst"

18 ],