Static Scan Results
scanned 5d ago · by rust-scannerStatic analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/constella-update.mjsView file
26*/
L27: import { spawnSync, spawn, execFileSync } from "node:child_process";
L28: import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/constella-update.mjsView on unpkg · L2665const alive = (p) => { try { process.kill(p, 0); return true; } catch { return false; } };
L66: const psout = (s) => { try { return execFileSync("powershell", ["-NoProfile", "-Command", s], { timeout: 9000, windowsHide: true }).toString(); } catch { return ""; } };
L67: const ints = (s) => s.split(/\r?\n/).map((x) => +x.trim()).filter((n) => n > 0);
High
11* Order matters: it INSTALLS FIRST, with the server still running. A live Constella does NOT lock the
L12: * global package files (verified on Windows — `npm i -g` succeeds with the server up), so installing first
L13: * just works, and if it can't we haven't taken the host down. Only THEN does it restart the server to load
...
L26: */
L27: import { spawnSync, spawn, execFileSync } from "node:child_process";
L28: import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/constella-update.mjsView on unpkg · L11bin/constella.mjsView file
318// on Windows. Best-effort — never blocks boot; the server binds 0.0.0.0 regardless.
L319: if (runMode === "vps" && process.env.CONSTELLA_SKIP_TAILSCALE !== "1") {
L320: if (process.platform === "win32") {
...
L323: const root = typeof process.getuid === "function" && process.getuid() === 0;
L324: const sh = (cmd) => { try { execFileSync("sh", ["-c", cmd], { stdio: "inherit" }); } catch { /* best-effort */ } };
L325: const tsOk = () => { try { return spawnSync("tailscale", ["version"], { stdio: "ignore" }).status === 0; } catch { return false; } };
L326: if (!tsOk()) { console.log("• Installing Tailscale…"); sh(`curl -fsSL https://tailscale.com/install.sh | ${root ? "" : "sudo "}sh`); }
L327: if (tsOk()) {
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/constella.mjsView on unpkg · L31819import { mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync, readdirSync, rmSync } from "node:fs";
L20: import { spawnSync, spawn, execFileSync } from "node:child_process";
L21: import { createInterface } from "node:readline";
...
L33: const cand = join(dir, "node_modules", pkg);
L34: if (existsSync(join(cand, "package.json"))) return cand;
L35: const parent = dirname(dir);
...
L46: try {
L47: const b = JSON.parse(readFileSync(join(d, "package.json"), "utf8")).bin;
L48: const rel = typeof b === "string" ? b : (b?.[binName] ?? b?.[pkg]);
...
L97: try {
L98: if (process.platform === "win32") {
L99: const d = (p[0] || "C").toUpperCase();
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/constella.mjsView on unpkg · L1965package = constellai; repositoryIdentity = constella; dependency = better-sqlite3
L65: // So we must actually OPEN a db to trigger the dlopen and surface an ABI mismatch.
L66: const tryLoad = () => { try { const D = nativeRequire("better-sqlite3"); new D(":memory:").close(); return null; } catch (e) { return e; } };
L67: const first = tryLoad();
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
bin/constella.mjsView on unpkg · L65scripts/vps-update.shView file
•path = scripts/vps-update.sh
kind = build_helper
sizeBytes = 3309
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/vps-update.shView on unpkgskills/front-end/web-artifacts-builder/scripts/shadcn-components.tar.gzView file
•path = skills/front-end/web-artifacts-builder/scripts/shadcn-components.tar.gz
kind = compressed_blob
sizeBytes = 19967
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
skills/front-end/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkgskills/design/theme-factory/theme-showcase.pdfView file
•path = skills/design/theme-factory/theme-showcase.pdf
kind = high_entropy_blob
sizeBytes = 124310
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
skills/design/theme-factory/theme-showcase.pdfView on unpkgFindings
8 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/constella-update.mjs
HighShellbin/constella-update.mjs
HighSame File Env Network Executionbin/constella.mjs
HighSandbox Evasion Gated Capabilitybin/constella.mjs
HighCopied Package Dependency Bridgebin/constella.mjs
HighRuntime Package Installbin/constella-update.mjs
HighShips High Entropy Blobskills/design/theme-factory/theme-showcase.pdf
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/vps-update.sh
MediumShips Compressed Blobskills/front-end/web-artifacts-builder/scripts/shadcn-components.tar.gz
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings