Loading npm security reports…

coderaft@0.0.37: Suspicious npm security report (Warn) | LPM Firewall

registry / coderaft / 0.0.37

coderaft@0.0.37

[![npm version](https://img.shields.io/npm/v/coderaft?color=blue)](https://npmx.dev/package/coderaft) [![install size](https://packagephobia.com/badge?p=coderaft)](https://packagephobia.com/result?p=coderaft)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 10 file(s), 74.7 KB of source, external domains: 127.0.0.1

Source & flagged code

7 flagged

dist/_chunks/server.mjsView file

Lines 1-40javascript

1import { createProxyServer } from "./libs/httpxy.mjs";

2import { createRequire } from "node:module";

3import { fileURLToPath, pathToFileURL } from "node:url";

4import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs";

5import { fork } from "node:child_process";

6import { randomBytes, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/_chunks/server.mjsView on unpkg · L4

7import { createServer } from "node:http";

8import { extname, join, normalize, sep } from "node:path";

9import { stat } from "node:fs/promises";

10import { loadCode } from "#code";

11var __defProp = Object.defineProperty;

12var __exportAll = (all, no_symbols) => {

13 let target = {};

14 for (var name in all) __defProp(target, name, {

15 get: all[name],

16 enumerable: true

17 });

18 if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });

19 return target;

20};

21var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();

22if (process.platform === "android") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/server.mjsView on unpkg · L20

23 if (process.execPath.includes("linker64") || process.execPath.startsWith("/apex/")) {

24 const resolved = process.env.TERMUX_EXEC__PROC_SELF_EXE || "/data/data/com.termux/files/usr/bin/node";

25 Object.defineProperty(process, "execPath", {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/_chunks/server.mjsView on unpkg · L4

26 value: resolved,

27 writable: true,

28 configurable: true,

29 enumerable: true

30 });

31 }

32 const preload = `--require "${fileURLToPath(import.meta.resolve("#android-preload"))}"`;

33 process.env.NODE_OPTIONS = process.env.NODE_OPTIONS ? `${process.env.NODE_OPTIONS} ${preload}` : preload;

34 const _fs = process.getBuiltinModule?.("fs") ?? __require("node:fs");

35 const { syncBuiltinESMExports: _syncESM } = process.getBuiltinModule?.("module") ?? __require("node:module");

36 const TERMUX_EXEC_LIB = "/data/data/com.termux/files/usr/lib/libtermux-exec.so";

37 try {

38 _fs.accessSync(TERMUX_EXEC_LIB);

39 const _cp = process.getBuiltinModule?.("child_process") ?? __require("node:child_process");

40 const _injectLdPreload = (opts) => {

dist/index.mjsView file

Lines 67-107javascript

67 #attachListeners(proc) {

68 const onExit = (code, signal) => this.emit("exit", code, signal);

69 const onError

code.tar.zstView file

•path = code.tar.zst kind = high_entropy_blob sizeBytes = 25171693 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

code.tar.zstView on unpkg

•path = code.tar.zst kind = compressed_blob sizeBytes = 25171693 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

code.tar.zstView on unpkg

package.jsonView file

Lines 10-50json

10 "LICENSE.md",

11 "ThirdPartyNotices.txt",

12 "tar.mjs",

13 "code.mjs",

14 "worker.mjs",

15 "install.mjs",

16 "android-preload.cjs"

Source & flagged code

7 flagged · loading source

dist/_chunks/server.mjsView file

Source & flagged code

7 flagged

dist/_chunks/server.mjsView file

Lines 1-40javascript

1import { createProxyServer } from "./libs/httpxy.mjs";

2import { createRequire } from "node:module";

3import { fileURLToPath, pathToFileURL } from "node:url";

4import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs";

5import { fork } from "node:child_process";

6import { randomBytes, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/_chunks/server.mjsView on unpkg · L4

7import { createServer } from "node:http";

8import { extname, join, normalize, sep } from "node:path";

9import { stat } from "node:fs/promises";

10import { loadCode } from "#code";

11var __defProp = Object.defineProperty;

12var __exportAll = (all, no_symbols) => {

13 let target = {};

14 for (var name in all) __defProp(target, name, {

15 get: all[name],

16 enumerable: true

17 });

18 if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });

19 return target;

20};

21var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();

22if (process.platform === "android") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/server.mjsView on unpkg · L20

23 if (process.execPath.includes("linker64") || process.execPath.startsWith("/apex/")) {

24 const resolved = process.env.TERMUX_EXEC__PROC_SELF_EXE || "/data/data/com.termux/files/usr/bin/node";

25 Object.defineProperty(process, "execPath", {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/_chunks/server.mjsView on unpkg · L4

26 value: resolved,

27 writable: true,

28 configurable: true,

29 enumerable: true

30 });

31 }

32 const preload = `--require "${fileURLToPath(import.meta.resolve("#android-preload"))}"`;

33 process.env.NODE_OPTIONS = process.env.NODE_OPTIONS ? `${process.env.NODE_OPTIONS} ${preload}` : preload;

34 const _fs = process.getBuiltinModule?.("fs") ?? __require("node:fs");

35 const { syncBuiltinESMExports: _syncESM } = process.getBuiltinModule?.("module") ?? __require("node:module");

36 const TERMUX_EXEC_LIB = "/data/data/com.termux/files/usr/lib/libtermux-exec.so";

37 try {

38 _fs.accessSync(TERMUX_EXEC_LIB);

39 const _cp = process.getBuiltinModule?.("child_process") ?? __require("node:child_process");

40 const _injectLdPreload = (opts) => {

dist/index.mjsView file

Lines 67-107javascript

67 #attachListeners(proc) {

68 const onExit = (code, signal) => this.emit("exit", code, signal);

69 const onError

code.tar.zstView file

•path = code.tar.zst kind = high_entropy_blob sizeBytes = 25171693 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

code.tar.zstView on unpkg

•path = code.tar.zst kind = compressed_blob sizeBytes = 25171693 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

code.tar.zstView on unpkg

package.jsonView file

Lines 10-50json

10 "LICENSE.md",

11 "ThirdPartyNotices.txt",

12 "tar.mjs",

13 "code.mjs",

14 "worker.mjs",

15 "install.mjs",

16 "android-preload.cjs"

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code