registry / depmod-ui / 0.4.4

depmod-ui@0.4.4

Visualise the dependency graph of a JavaScript / TypeScript project from your terminal.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 205 KB of source

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2import { realpathSync, statSync, mkdirSync, writeFileSync, readFileSync, existsSync, mkdtempSync, renameSync, readdirSync } from 'fs';

3import { isAbsolute, resolve, join, dirname, relative, sep, basename } from 'path';

4import { fileURLToPath } from 'url';

5import { Project, ts, SyntaxKind, Node } from 'ts-morph';

6import { createHash } from 'crypto';

7import picomatch from 'picomatch';

8import ignore from 'ignore';

9import ts$1 from 'typescript';

10import { parse } from 'yaml';

11import { Command } from 'commander';

12import kleur2 from 'kleur';

13import updateNotifier from 'update-notifier';

14import { spawn } from 'child_process';

15import { createServer } from 'net';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16import { tmpdir } from 'os';

17import chokidar from 'chokidar';

19if (Number(process.versions.node.split('.')[0]) < 20) {

20 console.error('depmod-ui requires Node.js >= 20.18. Detected ' + process.version + '.');

21 process.exit(1);

22}

23var __defProp = Object.defineProperty;

24var __export = (target, all) => {

25 for (var name in all)

26 __defProp(target, name, { get: all[name], enumerable: true });

27};

29// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js

30var external_exports = {};

31__export(external_exports, {

32 BRAND: () => BRAND,

33 DIRTY: () => DIRTY,

Lines 6034-6074javascript

6034 ...process.env,

6035 DEPMOD_SESSION_PATH: opts.sessionPath,

6036 DEPMOD_PROGRESS_PATH: opts.progressPath,

6037 DEPMOD_TARGET_ROOT: opts.targetRoot,

6038 DEPMOD_WATCH: opts.watch ? "1" : "",

6039 PORT: String(opts.port),

6040 HOSTNAME: opts.host

web/apps/web/.next/server/app/apple-icon.png.bodyView file

•path = web/apps/web/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 13950 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/apps/web/.next/server/app/apple-icon.png.bodyView on unpkg

•path = web/apps/web/.next/server/app/apple-icon.png.body kind = payload_in_excluded_dir sizeBytes = 13950 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/apps/web/.next/server/app/apple-icon.png.bodyView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

13import updateNotifier from 'update-notifier'; L14: import { spawn } from 'child_process'; L15: import { createServer } from 'net';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

6054{ cwd: server.cwd, env, stdio: ["ignore", "pipe", "pipe"] } L6055: ) : spawn("npx", ["next", "start", "--port", String(opts.port), "--hostname", opts.host], { L6056: cwd: server.cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L6054

web/apps/web/.next/server/app/apple-icon.png.bodyView file

•path = web/apps/web/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 13950 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/apps/web/.next/server/app/apple-icon.png.bodyView on unpkg

•path = web/apps/web/.next/server/app/apple-icon.png.body kind = payload_in_excluded_dir sizeBytes = 13950 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/apps/web/.next/server/app/apple-icon.png.bodyView on unpkg

Findings

5 High3 Medium3 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

HighShips High Entropy Blobweb/apps/web/.next/server/app/apple-icon.png.body

HighPayload In Excluded Dirweb/apps/web/.next/server/app/apple-icon.png.body

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2import { realpathSync, statSync, mkdirSync, writeFileSync, readFileSync, existsSync, mkdtempSync, renameSync, readdirSync } from 'fs';

3import { isAbsolute, resolve, join, dirname, relative, sep, basename } from 'path';

4import { fileURLToPath } from 'url';

5import { Project, ts, SyntaxKind, Node } from 'ts-morph';

6import { createHash } from 'crypto';

7import picomatch from 'picomatch';

8import ignore from 'ignore';

9import ts$1 from 'typescript';

10import { parse } from 'yaml';

11import { Command } from 'commander';

12import kleur2 from 'kleur';

13import updateNotifier from 'update-notifier';

14import { spawn } from 'child_process';

15import { createServer } from 'net';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16import { tmpdir } from 'os';

17import chokidar from 'chokidar';

19if (Number(process.versions.node.split('.')[0]) < 20) {

20 console.error('depmod-ui requires Node.js >= 20.18. Detected ' + process.version + '.');

21 process.exit(1);

22}

23var __defProp = Object.defineProperty;

24var __export = (target, all) => {

25 for (var name in all)

26 __defProp(target, name, { get: all[name], enumerable: true });

27};

29// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js

30var external_exports = {};

31__export(external_exports, {

32 BRAND: () => BRAND,

33 DIRTY: () => DIRTY,

Lines 6034-6074javascript

6034 ...process.env,

6035 DEPMOD_SESSION_PATH: opts.sessionPath,

6036 DEPMOD_PROGRESS_PATH: opts.progressPath,

6037 DEPMOD_TARGET_ROOT: opts.targetRoot,

6038 DEPMOD_WATCH: opts.watch ? "1" : "",

6039 PORT: String(opts.port),

6040 HOSTNAME: opts.host

web/apps/web/.next/server/app/apple-icon.png.bodyView file

•path = web/apps/web/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 13950 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/apps/web/.next/server/app/apple-icon.png.bodyView on unpkg

•path = web/apps/web/.next/server/app/apple-icon.png.body kind = payload_in_excluded_dir sizeBytes = 13950 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/apps/web/.next/server/app/apple-icon.png.bodyView on unpkg