registry / durindoor / 1.0.0

durindoor@1.0.0

DurinDoor AI Gateway

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 536 file(s), 2.35 MB of source, external domains: 127.0.0.1, 9cli.hxd.app, 9router.com, 9router.local, accounts.google.com, agent.api5.cursor.sh, agentn.api5.cursor.sh, ai-gateway.vercel.sh, ai.google.dev, ai.nube.sh, aiplatform.googleapis.com, aistudio.google.com, anthropic-compatible.test, antigravity.google, api-dashboard.search.brave.com, api-inference.huggingface.co, api.anthropic.com, api.assemblyai.com, api.bfl.ai, api.blackbox.ai, api.cartesia.ai, api.cast.ai, api.cerebras.ai, api.cline.bot, api.cloudflare.com, api.cohere.ai, api.cohere.com, api.commandcode.ai, api.deepgram.com, api.deepinfra.com, api.deepseek.com, api.dev.runwayml.com, api.elevenlabs.io, api.exa.ai, api.example.com, api.firecrawl.dev, api.fireworks.ai, api.github.com, api.githubcopilot.com, api.groq.com, api.hyperbolic.xyz, api.inworld.ai, api.jina.ai, api.kilo.ai, api.kimi.com, api.linkup.so, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.cn

Source & flagged code

12 flagged

.next/standalone/.next/server/chunks/4306.jsView file

Lines 1-1javascript

1"use strict";exports.id=4306,exports.ids=[4306],exports.modules={37221:(a,b,c)=>{let d;c.d(b,{RD:()=>p});var e=c(99129),f=c(89419),g=c(19035);function h(a){return(0,g.Gv)(a)}class i{#a;#b=new WeakMap;constructor(a){if(!function(a){return a&&"object"==typeof a&&Array.isArray(a.keys)&&a.keys.every(h)}(a))throw new e.Dm("JSON Web Key Set malformed");this.#a=structuredClone(a)}jwks(){return this.#a}async getKey(a,b){let{alg:c,kid:d}={...a,...b?.header},f=function(a){switch("string"==typeof a&&a.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP"; ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.next/standalone/.next/server/chunks/4306.jsView on unpkg · L1

Critical

Secret Pattern

RSA private key in .next/standalone/.next/server/chunks/4306.js

.next/standalone/.next/server/chunks/4306.jsView on unpkg · L1

Long lines were clipped for display.

open-sse/handlers/ttsProviders/localDevice.jsView file

Lines 1-55javascript

1// Local device TTS — macOS `say` + Windows SAPI + ffmpeg

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L1

4import { mkdtemp, readFile, rm } from

open-sse/shared/qoder/cosy.jsView file

Lines 23-63javascript

23 QODER_LOGIN_VERSION,

24 QODER_MACHINE_OS,

25 QODER_MACHINE_TYPE,

26 QODER_RSA_PUBLIC_KEY,

27} from "./constants.js";

29// AES-128 wants a 16-byte key. Match qodercli/Veria: take the first 16 chars

30// of a fresh UUID's canonical string (hyphens included). The key is fresh

cli/cli.jsView file

Lines 736-776javascript

736 const { startTerminalUI } = require("./src/cli/terminalUI");

737 await startTerminalUI(port);

738 // Loop continues, show menu again

739 } else if (choice ===

start.shView file

•path = start.sh kind = build_helper sizeBytes = 157 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

start.shView on unpkg

.next/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = .next/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

package.jsonView file

Lines 1-26json

2 "name": "durindoor",

3 "version": "1.0.0",

4 "description": "DurinDoor AI Gateway",

5 "private": false,

.next/standalone/.next/server/chunks/8971.jsView file

Lines 1-1javascript

1"use strict";exports.id=8971,exports.ids=[8971],exports.modules={8971:(a,b,c)=>{c.d(b,{

.next/server/chunks/4306.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in .next/server/chunks/4306.js

.next/server/chunks/4306.jsView on unpkg · L1

.next/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in .next/server/chunks/8971.js

.next/server/chunks/8971.jsView on unpkg · L1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code