registry  /  deepline  /  0.1.191

deepline@0.1.191

⚠ Under review

Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 180 file(s), 4.89 MB of source, external domains: 127.0.0.1, code.claude.com, code.deepline.com, deepline.com, deepline.coordinator.internal, deepline.dedup.internal, deepline.dynamic.internal, deepline.rate-state.internal, deepline.run-state.internal, deepline.runtime.internal

Source & flagged code

8 flagged · loading source
dist/cli/index.jsView file
4445var import_node_path4 = require("path"); L4446: var childProcess = __toESM(require("child_process")); L4447: var import_sync = require("csv-parse/sync");
High
Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4445
26// src/cli/proxy-env.ts L27: var import_undici = require("undici"); L28: function defaultPort(protocol) { ... L31: function proxyEnvValue(name) { L32: return process.env[name]?.trim() ?? ""; L33: } ... L252: "AGENTS.md", L253: "package.json", L254: "pyproject.toml" ... L290: } L291: function findNearestEnvFile(name, startDir = process.cwd()) { L292: let current = (0, import_node_path.resolve)(startDir);
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli/index.jsView on unpkg · L26
26Cross-file remote execution chain: dist/cli/index.js spawns dist/cli/index.mjs; helper contains network access plus dynamic code execution. L26: // src/cli/proxy-env.ts L27: var import_undici = require("undici"); L28: function defaultPort(protocol) { ... L31: function proxyEnvValue(name) { L32: return process.env[name]?.trim() ?? ""; L33: } ... L252: "AGENTS.md", L253: "package.json", L254: "pyproject.toml" ... L290: } L291: function findNearestEnvFile(name, startDir = process.cwd()) { L292: let current = (0, import_node_path.resolve)(startDir);
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L26
16420{ pattern: /(?<!\.)\brequire\s*\(/, reason: "require()" }, L16421: { pattern: /(?<!\.)\beval\s*\(/, reason: "eval()" }, L16422: {
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/index.jsView on unpkg · L16420
dist/cli/index.mjsView file
4778if (process.platform === "win32") { L4779: childProcess.execFileSync("cmd.exe", ["/c", "start", "", targetUrl], { L4780: stdio: "ignore"
High
Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L4778
dist/index.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = deepline@0.1.168 matchedIdentity = npm:ZGVlcGxpbmU:0.1.168 similarity = 0.558 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg
79// src/config.ts L80: var import_node_fs = require("fs"); L81: var import_node_os = require("os");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L79
dist/bundling-sources/shared_libs/play-runtime/dataset-id.tsView file
1import { createHash } from 'node:crypto'; L2:
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/bundling-sources/shared_libs/play-runtime/dataset-id.tsView on unpkg · L1

Findings

1 Critical4 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/cli/index.js
HighShelldist/cli/index.mjs
HighObfuscated Payload Loaderdist/cli/index.js
HighCross File Remote Execution Contextdist/cli/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/cli/index.js
LowWeak Cryptodist/bundling-sources/shared_libs/play-runtime/dataset-id.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings