registry  /  common-tg-service  /  1.3.233

common-tg-service@1.3.233

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 319 file(s), 2.00 MB of source, external domains: api.telegram.org, cms.paidgirls.site, helper-thge.onrender.com, internal.local, paidgirls.site, proxy.webshare.io, report-upi.netlify.app, tg-chats.netlify.app, tgchats.netlify.app, www.npoint.io, zomcall.netlify.app

Source & flagged code

3 flagged · loading source
dist/components/users/users.service.jsView file
471patternName = generic_password severity = medium line = 471 matchedText = password...1@',
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/components/users/users.service.jsView on unpkg · L471
package.jsonView file
•Runtime dependency names matching Node built-ins: https
High
Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg
dist/components/__tests__/api-test-helpers.jsView file
132patternName = generic_password severity = medium line = 132 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/components/__tests__/api-test-helpers.js

dist/components/__tests__/api-test-helpers.jsView on unpkg · L132

Findings

1 High4 Medium5 Low
HighNode Builtin Dependency Squatpackage.json
MediumSecret Patterndist/components/users/users.service.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/components/__tests__/api-test-helpers.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings