registry / djsk / 0.5.0

djsk@0.5.0

Jishaku for Discord.js — a debugging and diagnostics toolkit for your bot.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 151 KB of source, external domains: discord.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/index.jsView file

Lines 299-339javascript

299 version: "0.5.0"};

300

301// src/util/meta.ts

302var DJSK_VERSION = package_default.version;

303async function checkForUpdate() {

304 try {

305 const result = await isPackageLatest({ name: "djsk", version: DJSK_VERSION });

306 if (!result.success || !result.latestVersion) return null;

307 return { isLatest: result.isLatest, latestVersion: result.latestVersion };

308 } catch {

309 return null;

310 }

311}

312var LIBRARY_CANDIDATES = [

313 "discord.js",

314 "discord.js-selfbot-v13",

315 "discord.js-selfbot-youtsuho-v13"

316];

317async function detectLibrary() {

318 for (const name of LIBRARY_CANDIDATES) {

319 try {

320 const mod = await import(name);

321 const version = mod.version ?? mod.default?.version;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L319

322 if (version) return { name, version };

323 } catch {

324 }

325 }

326 return null;

327}

328async function loadLibraryModule() {

329 for (const name of LIBRARY_CANDIDATES) {

330 try {

331 const mod = await import(name);

332 if (mod.version ?? mod.default?.version) return mod;

333 } catch {

334 }

335 }

336 return null;

337}

338

339// src/commands/eval-shared.ts

dist/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import chalk from 'chalk';

3import { Command } from 'commander';

4import { consola } from 'consola';

5import { spawn } from 'child_process';

6import { mkdir, readdir, writeFile } from 'fs/promises';

Source & flagged code

2 flagged · loading source

dist/index.jsView file

319try { L320: const mod = await import(name); L321: const version = mod.version ?? mod.default?.version;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L319

dist/cli.jsView file

4import { consola } from 'consola'; L5: import { spawn } from 'child_process'; L6: import { mkdir, readdir, writeFile } from 'fs/promises'; ... L12: try { L13: const response = await fetch("https://discord.com/api/v10/oauth2/applications/@me", { L14: headers: { Authorization: `Bot ${token}` } ... L16: if (!response.ok) return null; L17: const data = await response.json(); L18: return data.id ?? null; ... L52: var KNOWN = ["npm", "pnpm", "yarn", "bun"]; L53: function detectPackageManager(env = process.env) { L54: const userAgent = env.npm[redacted];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L4

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/cli.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 299-339javascript

299 version: "0.5.0"};

300

301// src/util/meta.ts

302var DJSK_VERSION = package_default.version;

303async function checkForUpdate() {

304 try {

305 const result = await isPackageLatest({ name: "djsk", version: DJSK_VERSION });

306 if (!result.success || !result.latestVersion) return null;

307 return { isLatest: result.isLatest, latestVersion: result.latestVersion };

308 } catch {

309 return null;

310 }

311}

312var LIBRARY_CANDIDATES = [

313 "discord.js",

314 "discord.js-selfbot-v13",

315 "discord.js-selfbot-youtsuho-v13"

316];

317async function detectLibrary() {

318 for (const name of LIBRARY_CANDIDATES) {

319 try {

320 const mod = await import(name);

321 const version = mod.version ?? mod.default?.version;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L319

322 if (version) return { name, version };

323 } catch {

324 }

325 }

326 return null;

327}

328async function loadLibraryModule() {

329 for (const name of LIBRARY_CANDIDATES) {

330 try {

331 const mod = await import(name);

332 if (mod.version ?? mod.default?.version) return mod;

333 } catch {

334 }

335 }

336 return null;

337}

338

339// src/commands/eval-shared.ts

dist/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import chalk from 'chalk';

3import { Command } from 'commander';

4import { consola } from 'consola';

5import { spawn } from 'child_process';

6import { mkdir, readdir, writeFile } from 'fs/promises';