registry / flavor-code / 1.2.9

flavor-code@1.2.9

<p align="center"><a href="./README.md">English</a> | <b><a href="./README.zh-CN.md">简体中文</a></b></p>

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 19 file(s), 3.91 MB of source, external domains: 127.0.0.1, 192.168.1.100, api.example.com, github.com, json-schema.org, lite.duckduckgo.com, mcp.example.com, react.dev, www.bing.com, www.w3.org

Source & flagged code

3 flagged

dist/desktop/main.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/desktop/main.js: import { readFile as readFile31, stat as stat13, writeFile as writeFile15 } from "fs/promises"; baseURL: z.string().trim().url().max(2048).refine((value) => { baseURL: z2.string().url().optional(), authorizationUrl: z2.string().url().optional(), await handle.writeFile(data2); baseURL: HttpUrlInput, async function runInteractionManifest(manifest, baseUrl, createDriver) { if (!isLoopbackPreviewUrl(baseUrl)) throw new Error("D2C interaction preview must use a loopback HTTP URL");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/desktop/main.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/desktop/main.js: import { readFile as readFile31, stat as stat13, writeFile as writeFile15 } from "fs/promises"; await handle.writeFile(data2); var DesktopMessageDeliverySchema = z3.enum(["prompt", "steer", "followUp"]); import { copyFile, mkdir as mkdir2, open as open2, readFile, rename as rename2, rm as rm2, stat, unlink } from "fs/promises"; var defaultFileOperations = { rename: rename2, copyFile, unlink }; await handle.writeFile(token, "utf8"); await handle.writeFile(content, "utf8"); await operations.copyFile(temporary, path);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

Source & flagged code

3 flagged · loading source

dist/desktop/main.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code