registry / finkrouter / 1.1.5

finkrouter@1.1.5

FINK Orchestrator Core - Enterprise Installer

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 106 KB of source, external domains: api.finkrouter.io.vn, claude.ai, github.com, www.anthropic.com

Source & flagged code

2 flagged

cli.obf.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

3const a0_0x331aea=a0_0x5cc1;function a0_0x5cc1(_0x886842,_0x5bc530){_0x886842=_0x886842-0xde;const _0x35cd8c=a0_0x35cd();let _0x5cc1dc=_0x35cd8c[_0x886842];if(a0_0x5cc1['bBwRMq']===undefined){var _0x39a85a=function(_0x33fa21){const _0x4535c4='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x3dafc7='',_0x24ab67='';for(let _0x140185=0x0,_0x64d057,_0x5286ab,_0x103a00=0x0;_0x5286ab=_0x33fa21['charAt'](_0x103a00++);~_0x5286ab&&(_0x64d057=_0x140185%0x4?_0x64d057*0x40+_0x5286ab:_0x5286ab,_0x140185++%0x4)?_0x3dafc7+=String['fromCharCode'](0xff&_0x64d057>>(-0x2*_0x140185&0x6)): ...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

cli.obf.jsView on unpkg · L2

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli.obf.jsView on unpkg · L2

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

cli.obf.jsView file

2L3: const a0_0x331aea=a0_0x5cc1;function a0_0x5cc1(_0x886842,_0x5bc530){_0x886842=_0x886842-0xde;const _0x35cd8c=a0_0x35cd();let _0x5cc1dc=_0x35cd8c[_0x886842];if(a0_0x5cc1['bBwRMq']==...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

cli.obf.jsView on unpkg · L2

2L3: const a0_0x331aea=a0_0x5cc1;function a0_0x5cc1(_0x886842,_0x5bc530){_0x886842=_0x886842-0xde;const _0x35cd8c=a0_0x35cd();let _0x5cc1dc=_0x35cd8c[_0x886842];if(a0_0x5cc1['bBwRMq']==...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli.obf.jsView on unpkg · L2

Findings

2 High3 Medium4 Low

HighObfuscated Payload Loadercli.obf.js

HighObfuscated

MediumEnvironment Vars

MediumInstall Persistencecli.obf.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings