registry / cresc-server / 2026.7.5-f379d532

cresc-server@2026.7.5-f379d532

⚠ Under review

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 20 file(s), 4.92 MB of source, external domains: accounts.google.com, admin.cresc.dev, api.cresc.app, api.cresc.dev, api.github.com, api.nodemailer.com, app.cresc.dev, cdn.jsdelivr.net, cresc.dev, docs.stripe.com, ely.sia, ethereal.email, github.com, invoice.stripe.com, jira.mariadb.org, json-schema.org, mail.google.com, mths.be, nodejs.org, nodemailer.com, oauth2.googleapis.com, openidconnect.googleapis.com, prettier.io, pris.ly, pushy.reactnative.cn, react.dev, registry.npmjs.org, schemas.agentskills.io, stripe.com, sts.aliyuncs.com, update.react-native.cn, update.reactnative.cn, www.apple.com, www.googleapis.com, www.prisma.io, www.w3.org

Oversized source lightweight scan

lib/chunk-bvpa5h8h.js4.61 MB file, sampled 256 KB

HighEntropyStringsMinified

Source & flagged code

13 flagged

lib/chunk-fr375zh1.jsView file

42`).concat(`\r L43: `)}function z3($,Z){let X=-1;for(let Q=0;Q<$.length;Q+=2){if($[Q]!==Z)continue;if(X===-1){X=Q;continue}let J=$[X+1];if(Z===VQ&&J){let Y=r9($[Q+1],J);if(Y)$[X+1]=Y}$.splice(Q,2),Q-=... L44: `).some((X)=>X.indexOf("(https.js:")!==-1||X.indexOf("node:https:")!==-1)}createSocket($,Z,X){let Q={...Z,secureEndpoint:this.isSecureEndpoint(Z)};Promise.resolve().then(()=>this.c...

Critical

Protestware

Package source matches protestware-related patterns.

lib/chunk-fr375zh1.jsView on unpkg · L42

High

Child Process

Package source references child process execution.

lib/chunk-fr375zh1.jsView on unpkg · L42

3causes have become circular...`;let Q=R2($);if(Q)return Z.add($),X+` L4: caused by: `+BH(Q,Z);else return X},Ux=($)=>BH($,new Set),jH=($,Z,X)=>{if(!OZ($))return"";let Q=X?"":$.message||"";if(Z.has($))return Q+": ...";let J=R2($);if(J){Z.add($);let Y=typ... L5: ${P}`,O=`,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunk-fr375zh1.jsView on unpkg · L3

29patternName = generic_password severity = medium line = 29 matchedText = `),typeo...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunk-fr375zh1.jsView on unpkg · L29

lib/chunk-1vk0fyaf.jsView file

71L72: `);return L.split(",")}switch(H){case"hoist-pattern":case"public-hoist-pattern":return A(T)}return T}bk.exports=gk});var tk=P((ok)=>{var lk=V("os"),gA=V("path"),rk=lk.tmpdir(),NV=p... L73:

High

Shell

Package source references shell execution.

lib/chunk-1vk0fyaf.jsView on unpkg · L71

3loaded from: `+H+` L4: `);function D(x){var B=iD(uA.join(x,"prebuilds")).map(h5),C=B.filter(S5(WD,aD)).sort(K5)[0];if(!C)return;var c=uA.join(x,"prebuilds",C.name),R=iD(c).map(k5),G=R.filter(q5(PD,c5)),M... L5: * mime-types ... L13: * MIT Licensed L14: */RG=BG.exports=q_;function q_(H,T){if(this.stream=T.stream||process.stderr,typeof T=="number"){var A=T;T={},T.total=A}else{if(T=T||{},typeof H!="string")throw Error("format requir... L15: `),this.stream.write(this.lastDraw)};q_.prototype.terminate=function(){if(this.clear){if(this.stream.clearLine)this.stream.clearLine(),this.stream.cursorTo(0)}else this.stream.writ... L16: `)}});var IL=P((yD)=>{Object.defineProperty(yD,"__esModule",{value:!0});function Oi(H,T){for(var A in T)Object.defineProperty(H,A,{enumerable:!0,get:Object.getOwnPropertyDescriptor... L17: `,aabOpenApksFailed:"Failed to open generated .apks file",aabReadUniversalApkFailed:"Failed to read universal.apk",aabUniversalApkNotFound:"universal.apk not found in generated .ap...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/chunk-1vk0fyaf.jsView on unpkg · L3

1Cross-file remote execution chain: lib/chunk-1vk0fyaf.js spawns lib/chunk-fr375zh1.js; helper contains network access plus dynamic code execution. L1: // @bun L2: import{Y as fV,fa as sV,ga as AX,ha as LX,ia as _X,ja as IX,ka as EX,la as lC,na as cX,oa as oC,pa as DX}from"./chunk-n4gxjwwg.js";import{$a as rF,Va as oH,Wa as PH,Xa as MO,Ya as ... L3: loaded from: `+H+` L4: `);function D(x){var B=iD(uA.join(x,"prebuilds")).map(h5),C=B.filter(S5(WD,aD)).sort(K5)[0];if(!C)return;var c=uA.join(x,"prebuilds",C.name),R=iD(c).map(k5),G=R.filter(q5(PD,c5)),M... L5: * mime-types ... L9: */var SE=Q5(),mX=V("path").extname,N5=/^\s*([^;\s]*)(?:;|\s|$)/,jX=/^text\//i;bX.charset=w5;bX.charsets={lookup:w5};bX.contentType=vX;bX.extension=dX;bX.extensions=Object.create(nu... L10: `;SH.DEFAULT_CONTENT_TYPE="application/octet-stream";SH.prototype.append=function(H,T,A){if(A=A||{},typeof A==="string")A={filename:A};var L=dD.prototype.append.bind(this);if(typeo... L11: * node-progress ... L13: * MIT Licensed L14: */RG=BG.exports=q_;function q_(H,T){if(this.stream=T.stream||process.stderr,typeof T=="number"){var A=T;T={},T.total=A}else{if(T=T||{},typeof H!="string")throw Error("format requir... L15: `),t…

lib/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env bun

2// @bun

3import{A as vN,B as yN,C as mN,D as cN,E as lN,b as X9,c as m4,d as k9,e as dB,f as a0,g as bw,h as h0,i as BN,j as Qw,k as Gw,l as S8,m as

lib/node-hdiffpatch-q8ah3hfz.nodeView file

•path = lib/node-hdiffpatch-q8ah3hfz.node kind = native_binary sizeBytes = 463096 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/node-hdiffpatch-q8ah3hfz.nodeView on unpkg

lib/chunk-bvpa5h8h.jsView file

•path = lib/chunk-bvpa5h8h.js kind = oversized_source_file sizeBytes = 4837698 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunk-bvpa5h8h.jsView on unpkg

Source & flagged code

13 flagged · loading source

lib/chunk-fr375zh1.jsView file

Critical

Protestware

Package source matches protestware-related patterns.

lib/chunk-fr375zh1.jsView on unpkg · L42

High

Child Process

Package source references child process execution.

lib/chunk-fr375zh1.jsView on unpkg · L42

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunk-fr375zh1.jsView on unpkg · L3

29patternName = generic_password severity = medium line = 29 matchedText = `),typeo...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunk-fr375zh1.jsView on unpkg · L29

lib/chunk-1vk0fyaf.jsView file

71L72: `);return L.split(",")}switch(H){case"hoist-pattern":case"public-hoist-pattern":return A(T)}return T}bk.exports=gk});var tk=P((ok)=>{var lk=V("os"),gA=V("path"),rk=lk.tmpdir(),NV=p... L73:

High

Shell

Package source references shell execution.

lib/chunk-1vk0fyaf.jsView on unpkg · L71

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/chunk-1vk0fyaf.jsView on unpkg · L3

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/chunk-1vk0fyaf.jsView on unpkg · L1

89@#[line:`+H.lineNumber+",col:"+H.columnNumber+"]"}function AJ(H,T,A){if(typeof H=="string")return H.substr(T,A);else{if(H.length>=T+A||T)return new java.lang.String(H,T,A)+"";retur... L90: `,q.offset=(Q=J.offset)!=null?Q:0,q.width=(O=J.width)!=null?O:0,q.dontPrettyTextNodes=(S=(k=J.dontPrettyTextNodes)!=null?k:J.dontprettytextnodes)!=null?S:0,q.spaceBeforeSlash=(a=(N... L91: `+A.join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/chunk-1vk0fyaf.jsView on unpkg · L89

lib/index.jsView file

256patternName = generic_password severity = medium line = 256 matchedText = \u2022 \...resc

Medium

Secret Pattern

Hardcoded password in lib/index.js

lib/index.jsView on unpkg · L256

229`),console.warn(KY.valibot);break;case"effect":if(O9.effect)break;O9.effect=!0,console.warn("[@elysiajs/openapi] Effect Schema doesn't provide JSON Schema method on the schema"),co... L230: `),console.warn(KY.effect);break}if(w==="arktype")return V9(Z?.toJsonSchema?.());return V9(Z.toJSONSchema?.()??Z?.toJsonSchema?.())}catch(W){console.warn(W)}},V9=(Z)=>{if(!Z||typeo... L231:

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/index.jsView on unpkg · L229

2// @bun L3: import{A as vN,B as yN,C as mN,D as cN,E as lN,b as X9,c as m4,d as k9,e as dB,f as a0,g as bw,h as h0,i as BN,j as Qw,k as Gw,l as S8,m as xX,n as VY,o as uw,p as gN,q as v0,r as ... L4: Supported algorithms are: L5: "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,M8="secret must be a string or buffer",a9="key must be a str... L6: <html lang="en"> ... L229: `),console.warn(KY.valibot);break;case"effect":if(O9.effect)break;O9.effect=!0,console.warn("[@elysiajs/openapi] Effect Schema doesn't provide JSON Schema method on the schema"),co... L230: `),console.warn(KY.effect);break}if(w==="arktype")return V9(Z?.toJsonSchema?.());return V9(Z.toJSONSchema?.()??Z?.toJsonSchema?.())}catch(W){console.warn(W)}},V9=(Z)=>{if(!Z||typeo... L231: L232: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let X of Z.seen.entries()){let Q=X[1];if(J===X[0]){z(X);continue}if(Z.external){let H=Z.exter... L233: `)){let z=W.indexOf(QG);if(z<0)continue;let X=W.slice(z+QG.length).trim();if(!X)continue;try{let Q=JSON.parse(X);if(!R1(Q)){w++;continue}if(HG(Q.message)){Y++;continue}J.push

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/index.jsView on unpkg · L2

lib/node-hdiffpatch-q8ah3hfz.nodeView file

•path = lib/node-hdiffpatch-q8ah3hfz.node kind = native_binary sizeBytes = 463096 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/node-hdiffpatch-q8ah3hfz.nodeView on unpkg

lib/chunk-bvpa5h8h.jsView file

•path = lib/chunk-bvpa5h8h.js kind = oversized_source_file sizeBytes = 4837698 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunk-bvpa5h8h.jsView on unpkg

Findings

1 Critical7 High7 Medium6 Low

CriticalProtestwarelib/chunk-fr375zh1.js

HighChild Processlib/chunk-fr375zh1.js

HighShelllib/chunk-1vk0fyaf.js

HighSame File Env Network Executionlib/chunk-fr375zh1.js

HighCommand Output Exfiltrationlib/chunk-1vk0fyaf.js

HighCross File Remote Execution Contextlib/chunk-1vk0fyaf.js

HighObfuscated

HighOversized Source Filelib/chunk-bvpa5h8h.js

MediumSecret Patternlib/chunk-fr375zh1.js

MediumDynamic Requirelib/chunk-1vk0fyaf.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarylib/node-hdiffpatch-q8ah3hfz.node

MediumStructural Risk Force Deep Review

MediumSecret Patternlib/index.js

LowEvallib/index.js

LowWeak Cryptolib/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

13 flagged

lib/chunk-fr375zh1.jsView file

Critical

Protestware

Package source matches protestware-related patterns.

lib/chunk-fr375zh1.jsView on unpkg · L42

High

Child Process

Package source references child process execution.

lib/chunk-fr375zh1.jsView on unpkg · L42

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunk-fr375zh1.jsView on unpkg · L3

29patternName = generic_password severity = medium line = 29 matchedText = `),typeo...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunk-fr375zh1.jsView on unpkg · L29

lib/chunk-1vk0fyaf.jsView file

71L72: `);return L.split(",")}switch(H){case"hoist-pattern":case"public-hoist-pattern":return A(T)}return T}bk.exports=gk});var tk=P((ok)=>{var lk=V("os"),gA=V("path"),rk=lk.tmpdir(),NV=p... L73:

High

Shell

Package source references shell execution.

lib/chunk-1vk0fyaf.jsView on unpkg · L71

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/chunk-1vk0fyaf.jsView on unpkg · L3

lib/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env bun

2// @bun

3import{A as vN,B as yN,C as mN,D as cN,E as lN,b as X9,c as m4,d as k9,e as dB,f as a0,g as bw,h as h0,i as BN,j as Qw,k as Gw,l as S8,m as

lib/node-hdiffpatch-q8ah3hfz.nodeView file

•path = lib/node-hdiffpatch-q8ah3hfz.node kind = native_binary sizeBytes = 463096 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/node-hdiffpatch-q8ah3hfz.nodeView on unpkg

lib/chunk-bvpa5h8h.jsView file

•path = lib/chunk-bvpa5h8h.js kind = oversized_source_file sizeBytes = 4837698 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunk-bvpa5h8h.jsView on unpkg

Lines 209-249javascript

209openapi({

210 mapJsonSchema: {

211 zod: zodToJsonSchema

212 }

213})`,valibot:`import openapi from '@elysiajs/openapi'

214import { toJsonSchema } from '@valibot/to-json-schema'

215

216openapi({

217 mapJsonSchema: {

218 valibot: toJsonSchema

219 }

220})`,effect:`import { JSONSchema } from 'effect'

221

222openapi({

223 mapJsonSchema: {

224 effect: JSONSchema.make

225 }

226})`},O9={},U2=(Z)=>{if(Z.length===0)return{schema:void 0,notObjects:[]};if(Z.length===1)return Z[0].type==="object"?{schema:Z[0],notObjects:[]}:{schema:void 0,notObjects:Z};let J,Y=[],w=!1,W=!1;for(let z of Z){if(!z)continue;if(z.type!=="object"){Y.push(z);continue}if("additionalProperties"in z){if(z.additionalProperties===!0)w=!0;else if(z.additionalProperties===!1)W=!0}if(!J){J=z;continue}J={...J,...z,properties:{...J.properties,...z.properties},required:[...J?.required??[],...z.required??[]]}}if(J){if(J.required)J.required=[...new Set(J.required)];if(W)J.additionalProperties=!1;else if(w)J. ...

227`),console.warn(KY.zod4);else O9.zod3=!0,console.warn(`For Zod v3, please install zod-to-json-schema package and use it like this:

228`),console.warn(KY.zod3);break;case"valibot":if(O9.valibot)break;O9.valibot=!0,console.warn("[@elysiajs/openapi] Valibot require a separate package for JSON Schema conversion"),console.warn(`Please install @valibot/to-json-schema package and use it like this:

230`),console.warn(KY.effect);break}if(w==="arktype")return V9(Z?.toJsonSchema?.());return V9(Z.toJSONSchema?.()??Z?.toJsonSchema?.())}catch(W){console.warn(W)}},V9=(Z)=>{if

231

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/index.jsView on unpkg · L229

232Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let X of Z.seen.entries()){let Q=X[1];if(J===X[0]){z(X);continue}if(Z.external){let H=Z.external.registry.get(X[

233`)){let z=W.indexOf(QG);if(z<0)continue;let X=W.slice(z+QG.length).trim();if(!X)continue;try{let Q=JSON.parse(X);if(!R1(Q)){w++;continue}if(HG(Q.message)){Y++;continue}J.push(Q)}catch{w++}}return{events:J,ignored:Y,parseErrors:w}}function f1(Z){return`${Z.hostname}:${Z.pid}:${Z.id}:${Z.time}`}function h1(Z,J){let Y=Date.parse(Z.time),w=Date.parse(J.time);if(Y!==w)return Y-w;if(Z.hostname!==J.hostname)return Z.hostname.localeCompare(J.hostname);if(Z.pid!==J.pid)return Z.pid-J.pid;return Z.id-J.id}async function g1(){let Z=b1(),J=_1(),Y=[],w=0,W=0;for(let z of Z){let X=await k1(z,J);if(!X)contin ...

234if redis.call("GET", KEYS[1]) == ARGV[1] then

235 return redis.call("DEL", KEYS[1])

236end

237return 0

238`;async function FH({key:Z,onError:J,ttlSeconds:Y}){let w=DL();try{let W=await OH($w.send("SET",[Z,w,"EX",String(Y),"NX"]));return{acquired:

239Originating from:`;function _8(Z,J){if(!Z||!Z.stack||!J)return;let Y=J.substring(J.indexOf(`

240`)+1),w=Z.stack.indexOf(ZB),W=w>=0?Z.stack.substring(0,w):Z.stack;Z.stack=`${W}${ZB}

241${Y}`}class D0{getClientName(){throw Error("getClientName not implemented.")}makeRequest(Z,J,Y,w,W,z,X,Q){throw Error("makeRequest not implemented.")}static makeTimeoutError(){let Z=TypeError(D0.TIMEOUT_ERROR_CODE);return Z.code=D0.TIMEOUT_ERROR_CODE,Z}}D0.CONNECTION_CLOSED_ERROR_CODES=["ECONNRESET","EPIPE"];D0.TIMEOUT_ERROR_CODE="ETIMEDOUT";class k8{constructor(Z,J){this._statusCode=Z,this._headers=J}getStatusCode(){return this._statusCode}getHeaders(){return this._headers}getRawResponse(){throw Error("getRawResponse not implemented.")}toStream(Z){throw Error("toStream not implemented.")}toJS ...

242Learn more about webhook signing and explore webhook integration examples for various frameworks at https://docs.stripe.com/webhooks/signature`,E=L?`

243

244Note: The provided signing secret contains whitespace. This often indicates an extra newline or space is in the value`:"";if(!C){if(A)throw new t0(O,B,{message:`Webhook payload must be provided as a string or a Buffer (https://nodejs.org/api/buffer.html) instance representing the _raw_ request body.Payload was provided as a parsed JavaScript object instead.

245Signature verification is impossible without access to the original signed material.

246`+T+`

247`+E});throw new t0(O,B,{message:`No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe?

248 If a webhook request is being forwarded by a third-party tool, ensure that the exact request body, including JSON formatting and new line style, is preserved.

249`+T+`

Long lines were clipped for display.