registry / flavor-code / 1.2.15

flavor-code@1.2.15

<p align="center"><a href="./README.md">English</a> | <b><a href="./README.zh-CN.md">简体中文</a></b></p>

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 117 file(s), 5.02 MB of source, external domains: 127.0.0.1, 192.168.1.100, api.example.com, developer.mozilla.org, example.com, github.com, json-schema.org, lite.duckduckgo.com, mcp.example.com, react.dev, www.bing.com, www.w3.org

Source & flagged code

7 flagged

dist/astgraph/vendor/tree-sitter.jsView file

Lines 2957-2997javascript

2957 "env": proxy,

2958 "wasi_snapshot_preview1": proxy

2959 };

2960 function postInstantiation(module, instance) {

2961 updateTableMap(tableBase, metadata.tableSize);

2962 moduleExports = relocateExports(instance.exports, memoryBase);

2963 if (!flags.allowUndefined) {

2964 reportUndefinedSymbols();

2965 }

2966 function addEmAsm(addr, body) {

2967 var args = [];

2968 var arity = 0;

2969 for (; arity < 16; arity++) {

2970 if (body.indexOf("$" + arity) != -1) {

2971 args.push("$" + arity);

2972 } else {

2973 break;

2974 }

2975 }

2976 args = args.join(",");

2977 var func = `(${args}) => { ${body} };`;

2978 ASM_CONSTS[start] = eval(func);

2979 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/astgraph/vendor/tree-sitter.jsView on unpkg · L2977

2980 __name(addEmAsm, "addEmAsm");

2981 if ("__start_em_asm" in moduleExports) {

2982 var start = moduleExports["__start_em_asm"];

2983 var stop = moduleExports["__stop_em_asm"];

2984 while (start < stop) {

2985 var jsString = UTF8ToString(start);

2986 addEmAsm(start, jsString);

2987 start = HEAPU8.indexOf(0, start) + 1;

2988 }

2989 }

2990 function addEmJs(name, cSig, body) {

2991 var jsArgs = [];

2992 cSig = cSig.slice(1, -1);

2993 if (cSig != "void") {

2994 cSig = cSig.split(",");

2995 for (var i in cSig) {

2996 var jsArg = cSig[i].split(" ").pop();

2997 jsArgs.push(jsArg.replace("*", ""));

dist/astgraph/index.jsView file

Lines 9-49javascript

9// inside the host's activation timeout; WASM grammars and the database load on

10// first use.

12import { existsSync } from "node:fs";

13import { isAbsolute, join, relative } from "node:path";

15import { z } from "./vendor/zod/index.js"

dist/desktop/main.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/desktop/main.js: import { readFile as readFile34, stat as stat15, writeFile as writeFile18 } from "fs/promises"; baseURL: z.string().trim().url().max(2048).refine((value) => { baseURL: z2.string().url().optional(), authorizationUrl: z2.string().url().optional(), await handle.writeFile(data2); baseURL: HttpUrlInput, async function runInteractionManifest(manifest, baseUrl, createDriver) { if (!isLoopbackPreviewUrl(baseUrl)) throw new Error("D2C interaction preview must use a loopback HTTP URL");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/desktop/main.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/desktop/main.js: import { readFile as readFile34, stat as stat15, writeFile as writeFile18 } from "fs/promises"; await handle.writeFile(data2); var DesktopMessageDeliverySchema = z3.enum(["prompt", "steer", "followUp"]); import { copyFile, mkdir as mkdir2, open as open2, readFile, rename as rename2, rm as rm2, stat, unlink } from "fs/promises"; var defaultFileOperations = { rename: rename2, copyFile, unlink }; await handle.writeFile(token, "utf8"); await handle.writeFile(content, "utf8"); await operations.copyFile(temporary, path);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/desktop/main.jsView on unpkg

dist/astgraph/vendor/tree-sitter.wasmView file

•path = dist/astgraph/vendor/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/astgraph/vendor/tree-sitter.wasmView on unpkg

dist/chunk-5TG3E2EJ.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = flavor-code@1.2.11 matchedIdentity = npm:Zmxhdm9yLWNvZGU:1.2.11 similarity = 0.789 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-5TG3E2EJ.jsView on unpkg

Source & flagged code

7 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code