registry / flavor-code / 1.2.11

flavor-code@1.2.11

<p align="center"><a href="./README.md">English</a> | <b><a href="./README.zh-CN.md">简体中文</a></b></p>

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 19 file(s), 4.11 MB of source, external domains: 127.0.0.1, 192.168.1.100, api.example.com, github.com, json-schema.org, lite.duckduckgo.com, mcp.example.com, react.dev, www.bing.com, www.w3.org

Source & flagged code

3 flagged

dist/chunk-OT5XIN6G.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-OT5XIN6G.js: return text.replace(/\bsk-[A-Za-z0-9_-]+\b/g, "[redacted]").replace(/(authorization|api[_ -]?key|token)\s*[:=]\s*\S+/gi, "$1=[redacted]"); import { lstat, mkdir, readdir, readFile, realpath, writeFile } from "fs/promises"; await writeFile(path, `${existing}${separator}${append}${newline}`); authorizationUrl: "http://192.168.1.100:8091/authorize", await writeFile(configPath, JSON.stringify(example, null, 2) + "\n"); await writeFile(join(pluginDir, name), content); await writeFile(path, content); import { lstat as lstat2, mkdir as mkdir2, open, readFile as readFile2, readdir as readdir2, rename, rm, writeFile as w

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-OT5XIN6G.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-OT5XIN6G.js: import { lstat, mkdir, readdir, readFile, realpath, writeFile } from "fs/promises"; ...facts.instructionFiles.map((file) => `Follow \`${file}\`.`), await writeFile(path, `${existing}${separator}${append}${newline}`); await writeFile(configPath, JSON.stringify(example, null, 2) + "\n"); await writeFile(join(pluginDir, name), content); await writeFile(path, content); import { lstat as lstat2, mkdir as mkdir2, open, readFile as readFile2, readdir as readdir2, rename, rm, writeFile as writeFile2 } from "fs/promises"; var EXCLUDED = /* @__PURE__ */ new Set([".git", ".flavor", "node_modules", "dist", "build", "release", ".worktrees"]);

Source & flagged code

3 flagged · loading source

dist/chunk-OT5XIN6G.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code