registry  /  common-tg-service  /  1.3.237

common-tg-service@1.3.237

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 321 file(s), 2.00 MB of source, external domains: api.telegram.org, cms.paidgirls.site, helper-thge.onrender.com, internal.local, paidgirls.site, proxy.webshare.io, report-upi.netlify.app, tg-chats.netlify.app, tgchats.netlify.app, www.npoint.io, zomcall.netlify.app

Source & flagged code

4 flagged · loading source
dist/components/users/users.service.jsView file
471patternName = generic_password severity = medium line = 471 matchedText = password...1@',
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/components/users/users.service.jsView on unpkg · L471
package.jsonView file
•Runtime dependency names matching Node built-ins: https
High
Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg
dist/components/bots/bots.service.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = common-tg-service@1.3.236 matchedIdentity = npm:Y29tbW9uLXRnLXNlcnZpY2U:1.3.236 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/components/bots/bots.service.jsView on unpkg
dist/components/__tests__/api-test-helpers.jsView file
132patternName = generic_password severity = medium line = 132 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/components/__tests__/api-test-helpers.js

dist/components/__tests__/api-test-helpers.jsView on unpkg · L132

Findings

2 High4 Medium5 Low
HighNode Builtin Dependency Squatpackage.json
HighPrevious Version Dangerous Deltadist/components/bots/bots.service.js
MediumSecret Patterndist/components/users/users.service.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/components/__tests__/api-test-helpers.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings