registry  /  cresc-server  /  2026.7.5-d54327f8

cresc-server@2026.7.5-d54327f8

⚠ Under review

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Manifest
NoLicense
scanned 20 file(s), 4.91 MB of source, external domains: accounts.google.com, admin.cresc.dev, api.cresc.app, api.cresc.dev, api.github.com, api.nodemailer.com, app.cresc.dev, cdn.jsdelivr.net, cresc.dev, docs.stripe.com, ely.sia, ethereal.email, github.com, invoice.stripe.com, jira.mariadb.org, json-schema.org, mail.google.com, mths.be, nodejs.org, nodemailer.com, oauth2.googleapis.com, openidconnect.googleapis.com, prettier.io, pris.ly, pushy.reactnative.cn, react.dev, registry.npmjs.org, s.io, schemas.agentskills.io, stripe.com, sts.aliyuncs.com, update.react-native.cn, update.reactnative.cn, www.apple.com, www.googleapis.com, www.prisma.io, www.w3.org
Oversized source lightweight scan
lib/chunk-zmxzceeq.js4.61 MB file, sampled 256 KB
HighEntropyStringsMinified

Source & flagged code

13 flagged · loading source
lib/index.jsView file
278patternName = generic_password severity = medium line = 278 matchedText = \u2022 \...resc
Medium
Secret Pattern

Package contains a possible secret pattern.

lib/index.jsView on unpkg · L278
251`),console.warn(Q5.valibot);break;case"effect":if(L9.effect)break;L9.effect=!0,console.warn("[@elysiajs/openapi] Effect Schema doesn't provide JSON Schema method on the schema"),co... L252: `),console.warn(Q5.effect);break}if(J==="arktype")return E9(Z?.toJsonSchema?.());return E9(Z.toJSONSchema?.()??Z?.toJsonSchema?.())}catch(G){console.warn(G)}},E9=(Z)=>{if(!Z||typeo... L253:
Low
Eval

Package source references a known benign dynamic code generation pattern.

lib/index.jsView on unpkg · L251
4causes have become circular...`;let J=bJ(Z);if(J)return X.add(Z),Y+` L5: caused by: `+FQ(J,X);else return Y},vO=(Z)=>FQ(Z,new Set),qQ=(Z,X,Y)=>{if(!R8(Z))return"";let J=Y?"":Z.message||"";if(X.has(Z))return J+": ...";let G=bJ(Z);if(G){X.add(Z);let Q=typ... L6: ${M}`,I=`, ... L22: ${q}${f} L23: ${M}`;return F.pop(),`{${f}}`}case"number":return isFinite(V)?String(V):X?X(V):"null";case"boolean":return V===!0?"true":"false";case"undefined":return;case"bigint":if(J)return Str... L24: `:` ... L26: Supported algorithms are: L27: "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,l8="secret must be a string or buffer",A8="key must be a str... L28: <html lang="en"> ... L277: \u2022 \u603B\u8BA1\u83B7\u5F97 ${W+30} \u5929 ${X} \u670D\u52A1 L278: \u2022 \u5230\u671F\u65F6\u95F4\uFF1A${$.format("YYYY-MM-DD")}`;return console.log(U),{newExpiryDate:$.toDate(),paymentAmount:B,transferredDays:W,explanation:U}}var _U=new R({prefi... L279:
Low
Weak Crypto

Package source references weak cryptographic algorithms.

lib/index.jsView on unpkg · L4
lib/chunk-71x5n473.jsView file
15`),this.stream.write(this.lastDraw)};k_.prototype.terminate=function(){if(this.clear){if(this.stream.clearLine)this.stream.clearLine(),this.stream.cursorTo(0)}else this.stream.writ... L16: `)}});var _L=P((vD)=>{Object.defineProperty(vD,"__esModule",{value:!0});function zi(H,T){for(var A in T)Object.defineProperty(H,A,{enumerable:!0,get:Object.getOwnPropertyDescriptor... L17: `,aabOpenApksFailed:"Failed to open generated .apks file",aabReadUniversalApkFailed:"Failed to read universal.apk",aabUniversalApkNotFound:"universal.apk not found in generated .ap...
High
Child Process

Package source references child process execution.

lib/chunk-71x5n473.jsView on unpkg · L15
71L72: `);return L.split(",")}switch(H){case"hoist-pattern":case"public-hoist-pattern":return A(T)}return T}gk.exports=yk});var ok=P((rk)=>{var sk=V("os"),yA=V("path"),lk=sk.tmpdir(),OV=p... L73:
High
Shell

Package source references shell execution.

lib/chunk-71x5n473.jsView on unpkg · L71
1// @bun L2: import{Y as bV,fa as nV,ga as HX,ha as TX,ia as AX,ja as LX,ka as _X,la as sC,na as IX,oa as rC,pa as EX}from"./chunk-3jyt4dr4.js";import{$a as sF,Va as rH,Wa as PH,Xa as CO,Ya as ... L3: loaded from: `+H+` ... L15: `),this.stream.write(this.lastDraw)};k_.prototype.terminate=function(){if(this.clear){if(this.stream.clearLine)this.stream.clearLine(),this.stream.cursorTo(0)}else this.stream.writ... L16: `)}});var _L=P((vD)=>{Object.defineProperty(vD,"__esModule",{value:!0});function zi(H,T){for(var A in T)Object.defineProperty(H,A,{enumerable:!0,get:Object.getOwnPropertyDescriptor... L17: `,aabOpenApksFailed:"Failed to open generated .apks file",aabReadUniversalApkFailed:"Failed to read universal.apk",aabUniversalApkNotFound:"universal.apk not found in generated .ap...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunk-71x5n473.jsView on unpkg · L1
3loaded from: `+H+` L4: `);function D(x){var B=WD(pA.join(x,"prebuilds")).map(h5),C=B.filter(M5(PD,ZD)).sort(S5)[0];if(!C)return;var c=pA.join(x,"prebuilds",C.name),R=WD(c).map(K5),G=R.filter(k5(UD,E5)),h... L5: * mime-types ... L13: * MIT Licensed L14: */xG=RG.exports=k_;function k_(H,T){if(this.stream=T.stream||process.stderr,typeof T=="number"){var A=T;T={},T.total=A}else{if(T=T||{},typeof H!="string")throw Error("format requir... L15: `),this.stream.write(this.lastDraw)};k_.prototype.terminate=function(){if(this.clear){if(this.stream.clearLine)this.stream.clearLine(),this.stream.cursorTo(0)}else this.stream.writ... L16: `)}});var _L=P((vD)=>{Object.defineProperty(vD,"__esModule",{value:!0});function zi(H,T){for(var A in T)Object.defineProperty(H,A,{enumerable:!0,get:Object.getOwnPropertyDescriptor... L17: `,aabOpenApksFailed:"Failed to open generated .apks file",aabReadUniversalApkFailed:"Failed to read universal.apk",aabUniversalApkNotFound:"universal.apk not found in generated .ap...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/chunk-71x5n473.jsView on unpkg · L3
1Cross-file remote execution chain: lib/chunk-71x5n473.js spawns lib/index.js; helper contains network access plus dynamic code execution. L1: // @bun L2: import{Y as bV,fa as nV,ga as HX,ha as TX,ia as AX,ja as LX,ka as _X,la as sC,na as IX,oa as rC,pa as EX}from"./chunk-3jyt4dr4.js";import{$a as sF,Va as rH,Wa as PH,Xa as CO,Ya as ... L3: loaded from: `+H+` L4: `);function D(x){var B=WD(pA.join(x,"prebuilds")).map(h5),C=B.filter(M5(PD,ZD)).sort(S5)[0];if(!C)return;var c=pA.join(x,"prebuilds",C.name),R=WD(c).map(K5),G=R.filter(k5(UD,E5)),h... L5: * mime-types ... L9: */var ME=O5(),pX=V("path").extname,Q5=/^\s*([^;\s]*)(?:;|\s|$)/,uX=/^text\//i;yX.charset=N5;yX.charsets={lookup:N5};yX.contentType=mX;yX.extension=jX;yX.extensions=Object.create(nu... L10: `;SH.DEFAULT_CONTENT_TYPE="application/octet-stream";SH.prototype.append=function(H,T,A){if(A=A||{},typeof A==="string")A={filename:A};var L=jD.prototype.append.bind(this);if(typeo... L11: * node-progress ... L13: * MIT Licensed L14: */xG=RG.exports=k_;function k_(H,T){if(this.stream=T.stream||process.stderr,typeof T=="number"){var A=T;T={},T.total=A}else{if(T=T||{},typeof H!="string")throw Error("format requir... L15: `),this.strea…
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/chunk-71x5n473.jsView on unpkg · L1
89@#[line:`+H.lineNumber+",col:"+H.columnNumber+"]"}function TJ(H,T,A){if(typeof H=="string")return H.substr(T,A);else{if(H.length>=T+A||T)return new java.lang.String(H,T,A)+"";retur... L90: `,q.offset=(Q=J.offset)!=null?Q:0,q.width=(O=J.width)!=null?O:0,q.dontPrettyTextNodes=(M=(k=J.dontPrettyTextNodes)!=null?k:J.dontprettytextnodes)!=null?M:0,q.spaceBeforeSlash=(a=(N... L91: `+A.join(`
Medium
Dynamic Require

Package source references dynamic require/import behavior.

lib/chunk-71x5n473.jsView on unpkg · L89
lib/chunk-ajrj2d7w.jsView file
20`).concat(`\r L21: `)}function AW($,Z){let X=-1;for(let Q=0;Q<$.length;Q+=2){if($[Q]!==Z)continue;if(X===-1){X=Q;continue}let J=$[X+1];if(Z===NX&&J){let Y=hZ($[Q+1],J);if(Y)$[X+1]=Y}$.splice(Q,2),Q-=... L22: `).some((X)=>X.indexOf("(https.js:")!==-1||X.indexOf("node:https:")!==-1)}createSocket($,Z,X){let Q={...Z,secureEndpoint:this.isSecureEndpoint(Z)};Promise.resolve().then(()=>this.c...
Critical
Protestware

Package source matches protestware-related patterns.

lib/chunk-ajrj2d7w.jsView on unpkg · L20
7patternName = generic_password severity = medium line = 7 matchedText = `),typeo...ion.
Medium
Secret Pattern

Hardcoded password in lib/chunk-ajrj2d7w.js

lib/chunk-ajrj2d7w.jsView on unpkg · L7
lib/node-hdiffpatch-q8ah3hfz.nodeView file
•path = lib/node-hdiffpatch-q8ah3hfz.node kind = native_binary sizeBytes = 463096 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

lib/node-hdiffpatch-q8ah3hfz.nodeView on unpkg
lib/chunk-zmxzceeq.jsView file
•path = lib/chunk-zmxzceeq.js kind = oversized_source_file sizeBytes = 4837698 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunk-zmxzceeq.jsView on unpkg

Findings

1 Critical7 High7 Medium6 Low
CriticalProtestwarelib/chunk-ajrj2d7w.js
HighChild Processlib/chunk-71x5n473.js
HighShelllib/chunk-71x5n473.js
HighSame File Env Network Executionlib/chunk-71x5n473.js
HighCommand Output Exfiltrationlib/chunk-71x5n473.js
HighCross File Remote Execution Contextlib/chunk-71x5n473.js
HighObfuscated
HighOversized Source Filelib/chunk-zmxzceeq.js
MediumSecret Patternlib/index.js
MediumDynamic Requirelib/chunk-71x5n473.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarylib/node-hdiffpatch-q8ah3hfz.node
MediumStructural Risk Force Deep Review
MediumSecret Patternlib/chunk-ajrj2d7w.js
LowEvallib/index.js
LowWeak Cryptolib/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License