Loading npm security reports…

credstore@1.0.13: Suspicious npm security report (Warn) | LPM Firewall

registry / credstore / 1.0.13

credstore@1.0.13

Secure Offline Credential Manager

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 1.07 MB of source, external domains: github.com, nextjs.org, react.dev, www.w3.org

Source & flagged code

2 flagged

package.jsonView file

Lines 22-62json

22 "CHANGELOG.md",

23 "README.md",

24 "LICENSE"

25 ],

26 "homepage": "https://github.com/LocaMartin/credstore#readme",

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/LocaMartin/credstore.git"

30 },

31 "bugs": {

32 "url": "https://github.com/LocaMartin/credstore/issues"

33 },

34 "scripts": {

35 "dev": "next dev",

36 "build": "next build --webpack",

37 "start": "next start",

38 "lint": "eslint .",

39 "clean": "rimraf .next out dist",

40 "clean:all": "rimraf .next out dist node_modules",

41 "build:clean": "npm run clean && npm run build",

42 "postinstall": "node scripts/postinstall-desktop.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "test:security": "node scripts/security-smoke-test.mjs",

44 "dist:clean": "npm run clean && npm run dist-linux",

45 "prepack": "npm run export",

46 "export": "next build --webpack && node scripts/generate-integrity-manifest.mjs",

47 "electron": "electron .",

48 "electron-dev": "concurrently \"npm run dev\" \"wait-on http://localhost:3000 && electron .\"",

49 "build-electron": "npm run export && electron-builder",

50 "dist": "npm run export && electron-builder --publish=never",

51 "dist-linux": "npm run export && electron-builder --linux --publish=never",

52 "dist-windows": "npm run export && electron-builder --win --publish=never",

53 "dist-mac": "npm run export && electron-builder --mac --publish=never",

54 "dist-all": "npm run export && electron-builder --linux --win --mac --publish=never",

55 "release": "npm run release:linux && npm run release:windows && npm run release:mac",

56 "release:linux": "npm run export && electron-builder --linux --x64 --arm64 --publish=never",

57 "release:windows": "npm run export && electron-builder --win nsis --x64 --ia32 --publish=never",

58 "release:mac": "npm run export && electron-builder --mac dmg --x64 --arm64 --publish=never",

59 "android:init": "npm run build && npx cap add android",

60 "android:sync": "npm run build && npx cap sync android && node scripts/sync-android-version.js",

61 "android:build": "npm run android:sync && npx cap build android",

62 "android:run": "npm run android:sync && npx cap run android",

electron/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = credstore@1.0.8 matchedIdentity = npm:Y3JlZHN0b3Jl:1.0.8 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

electron/main.jsView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-desktop.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

electron/main.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

electron/main.jsView on unpkg

Findings

2 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltaelectron/main.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings