registry / filecat / 6.14.2

filecat@6.14.2

FileCat File Browser Server Manager

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 198 file(s), 14.6 MB of source, external domains: a.com, ark.cn-beijing.volces.com, bellard.org, chevrotain.io, esm.sh, example.com, fb.me, gcore.jsdelivr.net, git.io, github.com, konvajs.github.io, konvajs.org, neo.wordplex.io, npms.io, player.vimeo.com, q.qq.com, reactjs.org, twitter.com, www.figma.com, www.w3.org, www.youtube.com

Oversized source lightweight scan

build/main.js4.45 MB file, sampled 256 KB

FilesystemEnvironmentVarsHighEntropyStringsMinified

Source & flagged code

14 flagged

build/dist/5450.113da2885aa4cb937cab.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = "use str...}]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

build/dist/5450.113da2885aa4cb937cab.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = "use str...}]);

Critical

Secret Pattern

AWS access key ID in build/dist/5450.113da2885aa4cb937cab.js

build/dist/5450.113da2885aa4cb937cab.jsView on unpkg · L1

shell/build.jsView file

Lines 5-45javascript

5const os = require("os");

6const config = require('./config/webpack.web.config.js');

7const args = process.argv.slice(2)??[]; // slice to remove the first two default values

8let serverConfig ;

9const is_exe = args[0]==="exe"

10const is_npm = args[0]==="npm"

11if (args.length ===0 || is_npm) {

12 serverConfig = require('./config/webpack.npm.config.js');

13 console.log('npm打包')

14} else if (is_exe) {

15 console.log('二进制打包')

16 serverConfig = require('./config/webpack.exe.config.js');

17} else {

18 console.error('无法识别打包环境')

19}

20const {copyFileSync} = require("fs");

21const fs = require("fs");

22const path = require("path");

23const {rimraf} = require("rimraf");

24const fse = require("fs-extra");

25const {copy_wintun_dll} = require("./config/common-bin.config");

26const {execSync} = require("child_process");

High

Child Process

Package source references child process execution.

shell/build.jsView on unpkg · L25

28// const test_p = path.join(process.cwd(), "node_modules","node-process-watcher");

29// const test_p2 = path.join(process.cwd(), "node_modules","better-sqlite3");

30// console.log(`存在node-process-watcher ${fs.existsSync(test_p)}`);

31// console.log(`存在better-sqlite3 ${fs.existsSync(test_p2)}`);

33function ensure_copyFileSync(sourcePath, destPath) {

34 fse.ensureDirSync(path.dirname(destPath))

35 copyFileSync(sourcePath, destPath);

36}

38function get_platform () {

39 const platform = os.platform();

40 if(platform === "win32") {

41 return 'win'

42 } else if (platform === "linux") {

43 return 'linux'

44 } else if (platform === "darwin") {

45 return 'mac'

build/dist/1595.fba7940cddb86cb069ad.jsView file

1(self.webpackChunkfilecat=self.webpackChunkfilecat||[]).push([[1595],{62718(e,t,n){"use strict";var r=n(31601),a=n.n(r),i=n(76314),o=n.n(i),s=n(4417),l=n.n(s),c=new URL(n(60840),n....

High

Shell

Package source references shell execution.

build/dist/1595.fba7940cddb86cb069ad.jsView on unpkg · L1

build/dist/8257.744e045b48d91791722a.jsView file

Lines 1-2javascript

1/*! For license information please see 8257.744e045b48d91791722a.js.LICENSE.txt */

2(self.webpackChunkfilecat=self.webpackChunkfilecat||[]).push([[8257],{18257(e){var t;self,t=function(){return function(){var e={"./node_modules/es6-promise/dist/es6-promise.js":function(e,t,i

shell/util/file.jsView file

Lines 1-21javascript

1const fse = require("fs-extra");

2const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

shell/util/file.jsView on unpkg · L1

3const path = require("path");

shell/postinstall-optional.jsView file

Lines 2-30javascript

2const fs = require('fs');

3const path = require('path');

5// 获取当前 package.json 路径

6const pkgPath = path.resolve(__dirname, '..', 'package.json');

build/jieba_rs_wasm_bg.wasmView file

•path = build/jieba_rs_wasm_bg.wasm kind = wasm_module sizeBytes = 4015308 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

build/jieba_rs_wasm_bg.wasmView on unpkg

shell/start/filecat-uninstall.cmdView file

•path = shell/start/filecat-uninstall.cmd kind = build_helper sizeBytes = 30 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shell/start/filecat-uninstall.cmdView on unpkg

build/dist/2f6b8a5d7bad83cb7306.woff2View file

•path = build/dist/2f6b8a5d7bad83cb7306.woff2 kind = high_entropy_blob sizeBytes = 11912 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/dist/2f6b8a5d7bad83cb7306.woff2View on unpkg

build/main.jsView file

•path = build/main.js kind = oversized_source_file sizeBytes = 4662770 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/main.jsView on unpkg

build/dist/8090.d9f12bdd7719631e7dcf.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = (self.we...}]);

High

Secret Pattern

Google API key in build/dist/8090.d9f12bdd7719631e7dcf.js

build/dist/8090.d9f12bdd7719631e7dcf.jsView on unpkg · L2

build/dist/6413.38627ec984b26437de1e.jsView file

Lines 1-1javascript

1"use strict";(self.webpackChunkfilecat=self.webpackChunkfilecat||[]).push([[6413],{75897(e,t,s){s.d(t,{L:()=>i});let n=function(e){return e.username="username",e.password="password",e.password_hash=

build/dist/2851.0961ff82dbbafc9180ae.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = "use str...}]);

Medium

Secret Pattern

Hardcoded password in build/dist/2851.0961ff82dbbafc9180ae.js

build/dist/2851.0961ff82dbbafc9180ae.jsView on unpkg · L1

Source & flagged code

14 flagged · loading source

build/dist/5450.113da2885aa4cb937cab.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = "use str...}]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

build/dist/5450.113da2885aa4cb937cab.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = "use str...}]);

Critical

Secret Pattern

AWS access key ID in build/dist/5450.113da2885aa4cb937cab.js

build/dist/5450.113da2885aa4cb937cab.jsView on unpkg · L1

shell/build.jsView file

25const {copy_wintun_dll} = require("./config/common-bin.config"); L26: const {execSync} = require("child_process"); L27:

High

Child Process

Package source references child process execution.

shell/build.jsView on unpkg · L25

build/dist/1595.fba7940cddb86cb069ad.jsView file

1(self.webpackChunkfilecat=self.webpackChunkfilecat||[]).push([[1595],{62718(e,t,n){"use strict";var r=n(31601),a=n.n(r),i=n(76314),o=n.n(i),s=n(4417),l=n.n(s),c=new URL(n(60840),n....

High

Shell

Package source references shell execution.

build/dist/1595.fba7940cddb86cb069ad.jsView on unpkg · L1

build/dist/8257.744e045b48d91791722a.jsView file

1/*! For license information please see 8257.744e045b48d91791722a.js.LICENSE.txt */ L2: (self.webpackChunkfilecat=self.webpackChunkfilecat||[]).push([[8257],{18257(e){var t;self,t=function(){return function(){var e={"./node_modules/es6-promise/dist/es6-promise.js":fun...

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/dist/8257.744e045b48d91791722a.jsView on unpkg · L1

shell/util/file.jsView file

1const fse = require("fs-extra"); L2: const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

shell/util/file.jsView on unpkg · L1

shell/postinstall-optional.jsView file

22const globalFlag = process.env.npm[redacted] ? '-g' : ''; L23: execSync(`npm install ${dep}@${optionalDeps[dep]} ${globalFlag}`, { stdio: 'inherit' }); L24: console.log(`✅ ${dep} installed successfully`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

shell/postinstall-optional.jsView on unpkg · L22

build/jieba_rs_wasm_bg.wasmView file

•path = build/jieba_rs_wasm_bg.wasm kind = wasm_module sizeBytes = 4015308 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

build/jieba_rs_wasm_bg.wasmView on unpkg

shell/start/filecat-uninstall.cmdView file

•path = shell/start/filecat-uninstall.cmd kind = build_helper sizeBytes = 30 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shell/start/filecat-uninstall.cmdView on unpkg

build/dist/2f6b8a5d7bad83cb7306.woff2View file

•path = build/dist/2f6b8a5d7bad83cb7306.woff2 kind = high_entropy_blob sizeBytes = 11912 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/dist/2f6b8a5d7bad83cb7306.woff2View on unpkg

build/main.jsView file

•path = build/main.js kind = oversized_source_file sizeBytes = 4662770 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/main.jsView on unpkg

build/dist/8090.d9f12bdd7719631e7dcf.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = (self.we...}]);

High

Secret Pattern

Google API key in build/dist/8090.d9f12bdd7719631e7dcf.js

build/dist/8090.d9f12bdd7719631e7dcf.jsView on unpkg · L2

build/dist/6413.38627ec984b26437de1e.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = "use str...}]);

Medium

Secret Pattern

Hardcoded password in build/dist/6413.38627ec984b26437de1e.js

build/dist/6413.38627ec984b26437de1e.jsView on unpkg · L1

build/dist/2851.0961ff82dbbafc9180ae.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = "use str...}]);

Medium

Secret Pattern

Hardcoded password in build/dist/2851.0961ff82dbbafc9180ae.js

build/dist/2851.0961ff82dbbafc9180ae.jsView on unpkg · L1

Findings

2 Critical7 High9 Medium6 Low

CriticalCritical Secretbuild/dist/5450.113da2885aa4cb937cab.js

CriticalSecret Patternbuild/dist/5450.113da2885aa4cb937cab.js

HighChild Processshell/build.js

HighShellbuild/dist/1595.fba7940cddb86cb069ad.js

HighRuntime Package Installshell/postinstall-optional.js

HighObfuscated

HighShips High Entropy Blobbuild/dist/2f6b8a5d7bad83cb7306.woff2

HighOversized Source Filebuild/main.js

HighSecret Patternbuild/dist/8090.d9f12bdd7719631e7dcf.js

MediumDynamic Requireshell/util/file.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Modulebuild/jieba_rs_wasm_bg.wasm

MediumShips Build Helpershell/start/filecat-uninstall.cmd

MediumStructural Risk Force Deep Review

MediumSecret Patternbuild/dist/6413.38627ec984b26437de1e.js

MediumSecret Patternbuild/dist/2851.0961ff82dbbafc9180ae.js

LowScripts Present

LowEvalbuild/dist/8257.744e045b48d91791722a.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Authorxiaobaidadada

Maintainersxiaobaidadada

Version6.30.6

PublishedJun 30, 2026

LicenseApache-2.0

Dependencies7

Integrityverified

Package size23.1 MB

Files506

Keywords文件服务器linux管理Ai Agent知识库智能体运维面板远程桌面浏览器代理

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → build/plugin/index.jstypes → build/plugin/index.d.tsbin → filecat

RuntimeNo engine / OS / CPU constraints

Artifact37.5 MB · 506 files1 signature(s)

Install lifecycleNo install hooks · other: build, build-exe-linux-x64, build-exe-mac-arm, build-exe-pkg +8

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellHighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStringsManifest: clean

Source & flagged code

14 flagged

build/dist/5450.113da2885aa4cb937cab.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = "use str...}]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

build/dist/5450.113da2885aa4cb937cab.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = "use str...}]);

Critical

Secret Pattern

AWS access key ID in build/dist/5450.113da2885aa4cb937cab.js

build/dist/5450.113da2885aa4cb937cab.jsView on unpkg · L1

shell/build.jsView file

Lines 5-45javascript

5const os = require("os");

6const config = require('./config/webpack.web.config.js');

7const args = process.argv.slice(2)??[]; // slice to remove the first two default values

8let serverConfig ;

9const is_exe = args[0]==="exe"

10const is_npm = args[0]==="npm"

11if (args.length ===0 || is_npm) {

12 serverConfig = require('./config/webpack.npm.config.js');

13 console.log('npm打包')

14} else if (is_exe) {

15 console.log('二进制打包')

16 serverConfig = require('./config/webpack.exe.config.js');

17} else {

18 console.error('无法识别打包环境')

19}

20const {copyFileSync} = require("fs");

21const fs = require("fs");

22const path = require("path");

23const {rimraf} = require("rimraf");

24const fse = require("fs-extra");

25const {copy_wintun_dll} = require("./config/common-bin.config");

26const {execSync} = require("child_process");

High

Child Process

Package source references child process execution.

shell/build.jsView on unpkg · L25

28// const test_p = path.join(process.cwd(), "node_modules","node-process-watcher");

29// const test_p2 = path.join(process.cwd(), "node_modules","better-sqlite3");

30// console.log(`存在node-process-watcher ${fs.existsSync(test_p)}`);

31// console.log(`存在better-sqlite3 ${fs.existsSync(test_p2)}`);

33function ensure_copyFileSync(sourcePath, destPath) {

34 fse.ensureDirSync(path.dirname(destPath))

35 copyFileSync(sourcePath, destPath);

36}

38function get_platform () {

39 const platform = os.platform();

40 if(platform === "win32") {

41 return 'win'

42 } else if (platform === "linux") {

43 return 'linux'

44 } else if (platform === "darwin") {

45 return 'mac'

build/dist/1595.fba7940cddb86cb069ad.jsView file

1(self.webpackChunkfilecat=self.webpackChunkfilecat||[]).push([[1595],{62718(e,t,n){"use strict";var r=n(31601),a=n.n(r),i=n(76314),o=n.n(i),s=n(4417),l=n.n(s),c=new URL(n(60840),n....

High

Shell

Package source references shell execution.

build/dist/1595.fba7940cddb86cb069ad.jsView on unpkg · L1

build/dist/8257.744e045b48d91791722a.jsView file

Lines 1-2javascript

1/*! For license information please see 8257.744e045b48d91791722a.js.LICENSE.txt */

2(self.webpackChunkfilecat=self.webpackChunkfilecat||[]).push([[8257],{18257(e){var t;self,t=function(){return function(){var e={"./node_modules/es6-promise/dist/es6-promise.js":function(e,t,i

shell/util/file.jsView file

Lines 1-21javascript

1const fse = require("fs-extra");

2const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

shell/util/file.jsView on unpkg · L1

3const path = require("path");

shell/postinstall-optional.jsView file

Lines 2-30javascript

2const fs = require('fs');

3const path = require('path');

5// 获取当前 package.json 路径

6const pkgPath = path.resolve(__dirname, '..', 'package.json');

build/jieba_rs_wasm_bg.wasmView file

•path = build/jieba_rs_wasm_bg.wasm kind = wasm_module sizeBytes = 4015308 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

build/jieba_rs_wasm_bg.wasmView on unpkg

shell/start/filecat-uninstall.cmdView file

•path = shell/start/filecat-uninstall.cmd kind = build_helper sizeBytes = 30 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shell/start/filecat-uninstall.cmdView on unpkg

build/dist/2f6b8a5d7bad83cb7306.woff2View file

•path = build/dist/2f6b8a5d7bad83cb7306.woff2 kind = high_entropy_blob sizeBytes = 11912 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/dist/2f6b8a5d7bad83cb7306.woff2View on unpkg

build/main.jsView file

•path = build/main.js kind = oversized_source_file sizeBytes = 4662770 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/main.jsView on unpkg

build/dist/8090.d9f12bdd7719631e7dcf.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = (self.we...}]);

High

Secret Pattern

Google API key in build/dist/8090.d9f12bdd7719631e7dcf.js

build/dist/8090.d9f12bdd7719631e7dcf.jsView on unpkg · L2

build/dist/6413.38627ec984b26437de1e.jsView file

Lines 1-1javascript

1"use strict";(self.webpackChunkfilecat=self.webpackChunkfilecat||[]).push([[6413],{75897(e,t,s){s.d(t,{L:()=>i});let n=function(e){return e.username="username",e.password="password",e.password_hash=

build/dist/2851.0961ff82dbbafc9180ae.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = "use str...}]);

Medium

Secret Pattern

Hardcoded password in build/dist/2851.0961ff82dbbafc9180ae.js

build/dist/2851.0961ff82dbbafc9180ae.jsView on unpkg · L1