registry / flexbiz-server / 12.7.9

flexbiz-server@12.7.9

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 25 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 2,337 file(s), 26.9 MB of source, external domains: api.flexzen.app, api.geoapify.com, business.openapi.zalo.me, cdn.cdnservice.space, docs.google.com, graph.facebook.com, kekhaithue.gdt.gov.vn, oauth.zaloapp.com, oauth2.googleapis.com, schemas.xmlsoap.org, tempuri.org, unpkg.com, www.google.com, www.googleapis.com, www.w3.org, zalo.cloud

Oversized source lightweight scan

claude_cowork/src/data/sys/listinfo.js9.21 MB file, sampled 256 KB

HighEntropyStringsUrlStringsapi.flexzen.appzalo.cloud

server/data/sys/listinfo.js9.21 MB file, sampled 256 KB

Source & flagged code

15 flagged

claude_cowork/src/tools/update copy.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = global.G...eY';

High

High Secret

Package contains a high-severity secret pattern.

claude_cowork/src/tools/update copy.jsView on unpkg · L2

2patternName = google_api_key severity = high line = 2 matchedText = global.G...eY';

High

Secret Pattern

Google API key in claude_cowork/src/tools/update copy.js

claude_cowork/src/tools/update copy.jsView on unpkg · L2

claude_cowork/src/agents/tools/utils.jsView file

211try{ L212: const func = new Function("master","Moment","Numeral","API","utils","context","field","listInfo",body_func); L213: const context = getApiContext(doc.id_app)

Low

Eval

Package source references a known benign dynamic code generation pattern.

claude_cowork/src/agents/tools/utils.jsView on unpkg · L211

configs-example.jsView file

33//limit or slowDown request L34: const rateLimit = require("express-rate-limit"); L35: const slowDown = require('express-slow-down');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

configs-example.jsView on unpkg · L33

claude_cowork/src/models/schedule.jsView file

18if (_.isString(data)) { L19: try { data = JSON.parse(data); } catch(e) { L20: Logger.error("[schedule][runAIAgent] parse err:",e,data); ... L56: title: data.title, L57: body: data.body, L58: code: data.ma_ct || data.code, ... L96: L97: let processPath = path.join(path.dirname(__dirname), 'workers', 'runScript.js'); L98: if (!fs.existsSync(processPath)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude_cowork/src/models/schedule.jsView on unpkg · L18

server/route.jsView file

1function _0x1d14(_0x2f7bc5,_0x157f04){_0x2f7bc5=_0x2f7bc5-0x14f;const _0x523dc3=_0x523d();let _0x1d1450=_0x523dc3[_0x2f7bc5];if(_0x1d14['NDuqrI']===undefined){var _0xd3c17b=functio...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

server/route.jsView on unpkg · L1

enable_mongo_replica.shView file

•path = enable_mongo_replica.sh kind = build_helper sizeBytes = 3776 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

enable_mongo_replica.shView on unpkg

claude_cowork/src/templates/excels/pc1.xlsxView file

•path = claude_cowork/src/templates/excels/pc1.xlsx kind = compressed_blob sizeBytes = 12153 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

claude_cowork/src/templates/excels/pc1.xlsxView on unpkg

•path = claude_cowork/src/templates/excels/pc1.xlsx kind = nested_archive_needs_inspection sizeBytes = 12153 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

claude_cowork/src/templates/excels/pc1.xlsxView on unpkg

claude_cowork/src/templates/excels/pn5.xlsxView file

•path = claude_cowork/src/templates/excels/pn5.xlsx kind = high_entropy_blob sizeBytes = 12588 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

claude_cowork/src/templates/excels/pn5.xlsxView on unpkg

claude_cowork/src/data/sys/listinfo.jsView file

•path = claude_cowork/src/data/sys/listinfo.js kind = oversized_source_file sizeBytes = 9657799 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

claude_cowork/src/data/sys/listinfo.jsView on unpkg

claude_cowork/src/tools/create_province.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = global.G...eY';

High

Secret Pattern

Google API key in claude_cowork/src/tools/create_province.js

claude_cowork/src/tools/create_province.jsView on unpkg · L2

claude_cowork/src/tools/resetPassword.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = global.G...eY';

High

Secret Pattern

Google API key in claude_cowork/src/tools/resetPassword.js

claude_cowork/src/tools/resetPassword.jsView on unpkg · L2

claude_cowork/src/tools/set_px_gia_dd.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = global.G...eY';

High

Secret Pattern

Google API key in claude_cowork/src/tools/set_px_gia_dd.js

claude_cowork/src/tools/set_px_gia_dd.jsView on unpkg · L2

claude_cowork/src/tools/update_system.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = global.G...eY';

High

Secret Pattern

Google API key in claude_cowork/src/tools/update_system.js

claude_cowork/src/tools/update_system.jsView on unpkg · L2

Source & flagged code

15 flagged · loading source

claude_cowork/src/tools/update copy.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = global.G...eY';

High

High Secret

Package contains a high-severity secret pattern.

claude_cowork/src/tools/update copy.jsView on unpkg · L2

2patternName = google_api_key severity = high line = 2 matchedText = global.G...eY';

High

Secret Pattern

Google API key in claude_cowork/src/tools/update copy.js

claude_cowork/src/tools/update copy.jsView on unpkg · L2

claude_cowork/src/agents/tools/utils.jsView file

211try{ L212: const func = new Function("master","Moment","Numeral","API","utils","context","field","listInfo",body_func); L213: const context = getApiContext(doc.id_app)

Low

Eval

Findings

10 High8 Medium7 Low

HighHigh Secretclaude_cowork/src/tools/update copy.js

HighObfuscated Payload Loaderserver/route.js

HighObfuscated

HighShips High Entropy Blobclaude_cowork/src/templates/excels/pn5.xlsx

HighOversized Source Fileclaude_cowork/src/data/sys/listinfo.js

HighSecret Patternclaude_cowork/src/tools/update copy.js

HighSecret Patternclaude_cowork/src/tools/create_province.js

HighSecret Patternclaude_cowork/src/tools/resetPassword.js

HighSecret Patternclaude_cowork/src/tools/set_px_gia_dd.js

HighSecret Patternclaude_cowork/src/tools/update_system.js

MediumDynamic Requireconfigs-example.js

Medium