Loading npm security reports…

credstore@1.0.8: Suspicious npm security report (Warn) | LPM Firewall

registry / credstore / 1.0.8

credstore@1.0.8

Secure Offline Credential Manager

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 1.04 MB of source, external domains: github.com, nextjs.org, react.dev, www.w3.org

Source & flagged code

1 flagged

package.jsonView file

Lines 22-62json

22 "CHANGELOG.md",

23 "README.md",

24 "LICENSE"

25 ],

26 "homepage": "https://github.com/LocaMartin/credstore#readme",

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/LocaMartin/credstore.git"

30 },

31 "bugs": {

32 "url": "https://github.com/LocaMartin/credstore/issues"

33 },

34 "scripts": {

35 "dev": "next dev",

36 "build": "next build --webpack",

37 "start": "next start",

38 "lint": "eslint .",

39 "clean": "rimraf .next out dist",

40 "clean:all": "rimraf .next out dist node_modules",

41 "build:clean": "npm run clean && npm run build",

42 "postinstall": "node scripts/postinstall-desktop.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "test:security": "node scripts/security-smoke-test.mjs",

44 "dist:clean": "npm run clean && npm run dist-linux",

45 "prepack": "npm run export",

46 "export": "next build --webpack",

47 "electron": "electron .",

48 "electron-dev": "concurrently \"npm run dev\" \"wait-on http://localhost:3000 && electron .\"",

49 "build-electron": "npm run export && electron-builder",

50 "dist": "npm run export && electron-builder --publish=never",

51 "dist-linux": "npm run export && electron-builder --linux --publish=never",

52 "dist-windows": "npm run export && electron-builder --win --publish=never",

53 "dist-mac": "npm run export && electron-builder --mac --publish=never",

54 "dist-all": "npm run export && electron-builder --linux --win --mac --publish=never",

55 "release": "npm run release:linux && npm run release:windows && npm run release:mac",

56 "release:linux": "npm run export && electron-builder --linux --x64 --arm64 --publish=never",

57 "release:windows": "npm run export && electron-builder --win nsis --x64 --ia32 --publish=never",

58 "release:mac": "npm run export && electron-builder --mac dmg --x64 --arm64 --publish=never",

59 "android:init": "npm run build && npx cap add android",

60 "android:sync": "npm run build && npx cap sync android && node scripts/sync-android-version.js",

61 "android:build": "npm run android:sync && npx cap build android",

62 "android:run": "npm run android:sync && npx cap run android",

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-desktop.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings