Static Scan Results
scanned 17h ago · by rust-scannerStatic analysis flagged 21 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Oversized source lightweight scan
lib/chunk-3wazdm7d.js4.61 MB file, sampled 256 KB
HighEntropyStringsMinified
Source & flagged code
13 flagged · loading sourcelib/chunk-tyfj59xz.jsView file
20`).concat(`\r
L21: `)}function AW($,Z){let X=-1;for(let Q=0;Q<$.length;Q+=2){if($[Q]!==Z)continue;if(X===-1){X=Q;continue}let J=$[X+1];if(Z===NX&&J){let Y=hZ($[Q+1],J);if(Y)$[X+1]=Y}$.splice(Q,2),Q-=...
L22: `).some((X)=>X.indexOf("(https.js:")!==-1||X.indexOf("node:https:")!==-1)}createSocket($,Z,X){let Q={...Z,secureEndpoint:this.isSecureEndpoint(Z)};Promise.resolve().then(()=>this.c...
Critical
Protestware
Package source matches protestware-related patterns.
lib/chunk-tyfj59xz.jsView on unpkg · L206${JSON.stringify(W)}
L7: `),typeof K==="string"||K instanceof Uint8Array)J(K);else{let z;try{z=JSON.stringify(K)}catch{z=JSON.stringify(_0(K))}J(z)}}return typeof Q==="string"?Q:FT(Q)}function FT($){let Z=...
L8: Event: ${f1($)}`),!0;if(Vh($))return q&&j.warn(`Event dropped due to not having an error message, error type or stacktrace.
...
L17: Error:`,J)}}var q5=new Set([]);function L5($){let X=WJ("console",$);return x9("console",_h),X}function BH($){for(let Z of $)q5.add(Z);return()=>{for(let Z of $)q5.delete(Z)}}functi...
L18: Reason: ${B}`)})}_process($,Z){this._numProcessing++,this._promiseBuffer.add($).then((X)=>{return this._numProcessing--,X},(X)=>{if(this._numProcessing--,X===T9)this.recordDroppedE...
L19: `),X=[];for(let Q of Z)try{let J=Q.indexOf(":");if(J===-1)continue;let Y=Q.slice(0,J).trim(),W=Q.slice(J+1).trim();if(Y)X.push(Y,W)}catch{j.warn(`Failed to convert string request h...
L20: `).concat(`\r
L21: `)}function AW($,Z){let X=-1;for(let Q=0;Q<$.length;Q+=2){if($[Q]!==Z)continue;if(X===-1){X=Q;continue}let J=$[X+1];if(Z===NX&&J){let Y=hZ($[Q+1],J);if(Y)$[X+1]=Y}$.splice(Q,2),Q-=...
L22: `).some((X)=>X.indexOf("(https.js:")!==-1||X.indexOf("node:https:")!==-1)}c
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/chunk-tyfj59xz.jsView on unpkg · L67patternName = generic_password
severity = medium
line = 7
matchedText = `),typeo...ion.
Medium
lib/chunk-mtgyg0dg.jsView file
46`).pop()))return;if(this.options.debug||this.options.transactionLog)this.logger.debug({tnx:"server"},i.replace(/\r?\n$/,""));if(!i.trim())setImmediate(()=>this._processResponse());...
L47: `,"utf-8"))}_setEnvelope(i,t){let n=[],u=!1;if(this._envelope=i||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(...
L48: `].includes((i.newline||"").toString().toLowerCase())}send(i,t){i.message.keepBcc=!0;let n=i.data.envelope||i.message.getEnvelope(),u=i.message.messageId(),a;if([].concat(n.from||[...
High
Child Process
Package source references child process execution.
lib/chunk-mtgyg0dg.jsView on unpkg · L46lib/chunk-7xzqr796.jsView file
71L72: `);return L.split(",")}switch(H){case"hoist-pattern":case"public-hoist-pattern":return A(T)}return T}gk.exports=yk});var ok=P((rk)=>{var sk=V("os"),yA=V("path"),lk=sk.tmpdir(),OV=p...
L73:
High
3loaded from: `+H+`
L4: `);function D(x){var B=WD(pA.join(x,"prebuilds")).map(h5),C=B.filter(M5(PD,ZD)).sort(S5)[0];if(!C)return;var c=pA.join(x,"prebuilds",C.name),R=WD(c).map(K5),G=R.filter(k5(UD,E5)),h...
L5: * mime-types
...
L13: * MIT Licensed
L14: */xG=RG.exports=k_;function k_(H,T){if(this.stream=T.stream||process.stderr,typeof T=="number"){var A=T;T={},T.total=A}else{if(T=T||{},typeof H!="string")throw Error("format requir...
L15: `),this.stream.write(this.lastDraw)};k_.prototype.terminate=function(){if(this.clear){if(this.stream.clearLine)this.stream.clearLine(),this.stream.cursorTo(0)}else this.stream.writ...
L16: `)}});var _L=P((vD)=>{Object.defineProperty(vD,"__esModule",{value:!0});function zi(H,T){for(var A in T)Object.defineProperty(H,A,{enumerable:!0,get:Object.getOwnPropertyDescriptor...
L17: `,aabOpenApksFailed:"Failed to open generated .apks file",aabReadUniversalApkFailed:"Failed to read universal.apk",aabUniversalApkNotFound:"universal.apk not found in generated .ap...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
lib/chunk-7xzqr796.jsView on unpkg · L31Cross-file remote execution chain: lib/chunk-7xzqr796.js spawns lib/chunk-tyfj59xz.js; helper contains network access plus dynamic code execution.
L1: // @bun
L2: import{Y as bV,fa as nV,ga as HX,ha as TX,ia as AX,ja as LX,ka as _X,la as sC,na as IX,oa as rC,pa as EX}from"./chunk-0yt1k2zj.js";import{$a as hi,Qa as rH,Ra as PH,Sa as CO,Ta as ...
L3: loaded from: `+H+`
L4: `);function D(x){var B=WD(pA.join(x,"prebuilds")).map(h5),C=B.filter(M5(PD,ZD)).sort(S5)[0];if(!C)return;var c=pA.join(x,"prebuilds",C.name),R=WD(c).map(K5),G=R.filter(k5(UD,E5)),h...
L5: * mime-types
...
L9: */var ME=O5(),pX=V("path").extname,Q5=/^\s*([^;\s]*)(?:;|\s|$)/,uX=/^text\//i;yX.charset=N5;yX.charsets={lookup:N5};yX.contentType=mX;yX.extension=jX;yX.extensions=Object.create(nu...
L10: `;SH.DEFAULT_CONTENT_TYPE="application/octet-stream";SH.prototype.append=function(H,T,A){if(A=A||{},typeof A==="string")A={filename:A};var L=jD.prototype.append.bind(this);if(typeo...
L11: * node-progress
...
L13: * MIT Licensed
L14: */xG=RG.exports=k_;function k_(H,T){if(this.stream=T.stream||process.stderr,typeof T=="number"){var A=T;T={},T.total=A}else{if(T=T||{},typeof H!="string")throw Error("format requir...
L15: `),t…
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
lib/chunk-7xzqr796.jsView on unpkg · L1lib/index.jsView file
278patternName = generic_password
severity = medium
line = 278
matchedText = \u2022 \...resc
Medium
251`),console.warn(w5.valibot);break;case"effect":if(L9.effect)break;L9.effect=!0,console.warn("[@elysiajs/openapi] Effect Schema doesn't provide JSON Schema method on the schema"),co...
L252: `),console.warn(w5.effect);break}if(J==="arktype")return E9(Z?.toJsonSchema?.());return E9(Z.toJSONSchema?.()??Z?.toJsonSchema?.())}catch(G){console.warn(G)}},E9=(Z)=>{if(!Z||typeo...
L253:
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/index.jsView on unpkg · L2514causes have become circular...`;let J=SJ(Z);if(J)return Y.add(Z),X+`
L5: caused by: `+AQ(J,Y);else return X},xO=(Z)=>AQ(Z,new Set),FQ=(Z,Y,X)=>{if(!R8(Z))return"";let J=X?"":Z.message||"";if(Y.has(Z))return J+": ...";let G=SJ(Z);if(G){Y.add(Z);let Q=typ...
L6: ${M}`,I=`,
...
L22: ${q}${f}
L23: ${M}`;return F.pop(),`{${f}}`}case"number":return isFinite(B)?String(B):Y?Y(B):"null";case"boolean":return B===!0?"true":"false";case"undefined":return;case"bigint":if(J)return Str...
L24: `:`
...
L26: Supported algorithms are:
L27: "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,l8="secret must be a string or buffer",A8="key must be a str...
L28: <html lang="en">
...
L277: \u2022 \u603B\u8BA1\u83B7\u5F97 ${W+30} \u5929 ${Y} \u670D\u52A1
L278: \u2022 \u5230\u671F\u65F6\u95F4\uFF1A${$.format("YYYY-MM-DD")}`;return console.log(O),{newExpiryDate:$.toDate(),paymentAmount:V,transferredDays:W,explanation:O}}var LU=new R({prefi...
L279:
Low
lib/chunk-2fzh8vzf.jsView file
1// @bun
L2: import{Db as $0}from"./chunk-qythdk22.js";import{Eb as Y0}from"./chunk-1knnyw86.js";/*! ieee754. BSD-3-Clause License. Feross Aboukhadijeh <https://feross.org/opensource> */var $1=...
L3: `,"\r","\t"," ","\x00"].some((J)=>this.checkString(J,{offset:6})))return{ext:"vtt",mime:"text/vtt"};if(this.check([137,80,78,71,13,10,26,10]))return z1(G);if(this.check([65,82,82,7...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
lib/chunk-2fzh8vzf.jsView on unpkg · L1lib/node-hdiffpatch-q8ah3hfz.nodeView file
•path = lib/node-hdiffpatch-q8ah3hfz.node
kind = native_binary
sizeBytes = 463096
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
lib/node-hdiffpatch-q8ah3hfz.nodeView on unpkglib/chunk-3wazdm7d.jsView file
•path = lib/chunk-3wazdm7d.js
kind = oversized_source_file
sizeBytes = 4837698
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
lib/chunk-3wazdm7d.jsView on unpkgFindings
1 Critical7 High7 Medium6 Low
CriticalProtestwarelib/chunk-tyfj59xz.js
HighChild Processlib/chunk-mtgyg0dg.js
HighShelllib/chunk-7xzqr796.js
HighSame File Env Network Executionlib/chunk-tyfj59xz.js
HighCommand Output Exfiltrationlib/chunk-7xzqr796.js
HighCross File Remote Execution Contextlib/chunk-7xzqr796.js
HighObfuscated
HighOversized Source Filelib/chunk-3wazdm7d.js
MediumSecret Patternlib/chunk-tyfj59xz.js
MediumDynamic Requirelib/chunk-2fzh8vzf.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarylib/node-hdiffpatch-q8ah3hfz.node
MediumStructural Risk Force Deep Review
MediumSecret Patternlib/index.js
LowEvallib/index.js
LowWeak Cryptolib/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License