registry / dexbot / 1.1.11

dexbot@1.1.11

The first open source trading bot with zero runtime dependencies and a fully adaptive market making strategy.

Static Scan Results

scanned 58m ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 195 file(s), 3.48 MB of source, external domains: api.binance.com, api.bitget.com, api.bybit.com, api.gateio.ws, api.htx.com, api.kraken.com, api.kucoin.com, api.mexc.com, api.openai.com, github.com, kibana.bitshares.dev, www.okx.com

Source & flagged code

8 flagged

package.jsonView file

Lines 49-89json

49 "analysis:derivatives": "tsx analysis/analyze_derivatives.ts",

50 "analysis:trade-pnl": "tsx analysis/trade_profitability.ts",

51 "native:release-gates": "tsx scripts/native_release_gates.ts",

52 "native:serial-snapshots": "tsx tests/test_native_serial_ops.ts",

53 "native:ecc-invariants": "tsx tests/test_native_ecc.ts",

54 "native:corpus": "tsx scripts/generate_mainnet_corpus_report.ts",

55 "test:credit-renewal": "tsx scripts/test-credit-renewal.ts",

56 "version:sync": "tsx scripts/sync-version.ts",

57 "version:check": "tsx scripts/sync-version.ts --check",

58 "verify:browser-bundle": "tsx scripts/verify-browser-bundle.ts",

59 "test": "node --import tsx scripts/run-tests.ts",

60 "test:live": "RUN_LIVE_BITSHARES_TESTS=1 node --import tsx scripts/run-tests.ts",

61 "clean": "node scripts/clean-dist.js",

62 "build": "npm run clean && tsc",

63 "typecheck": "tsc --noEmit || true",

64 "build:watch": "tsc --watch",

65 "version": "npm run version:sync && npm run build",

66 "postversion": "npm run build",

67 "prepack": "npm run build",

68 "prepare": "npm run build",

69 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L69

70 },

71 "repository": {

72 "type": "git",

73 "url": "git+https://github.com/froooze/DEXBot2.git"

74 },

75 "keywords": [

76 "bitshares",

77 "trading",

78 "market-making",

79 "grid-trading",

80 "dex",

81 "blockchain",

82 "crypto",

83 "algorithmic-trading"

84 ],

85 "author": "",

86 "license": "MIT",

87 "type": "commonjs",

88 "browser": {

89 "./dist/credential-daemon.js": false,

dist/modules/chain_keys.jsView file

Lines 664-704javascript

664 if (confirmPassword === '\x1b')

665 return currentSecret;

666 if (newPassword !== confirmPassword) {

667 console.log('Passwords do not match!');

668

dist/pm2.jsView file

Lines 48-114javascript

48 * - Filters only active bots (active !== false)

49 * - If bot-name provided, filters to only that bot

50 * - In claw-only mode, generates only the credential daemon app

dist/scripts/update.jsView file

Lines 405-445javascript

405 }

406 catch (_2) { }

407 }

408 // Unconditionally drop the stash entry — no orphan accumulation

409 try {

410 execSync(`git stash drop ${stashRef} 2>/dev/null`, { stdio: 'pipe', cwd:

claw/scripts/memu_runner.pyView file

•path = claw/scripts/memu_runner.py kind = build_helper sizeBytes = 13322 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

claw/scripts/memu_runner.pyView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code