registry / flexbiz-server / 12.8.4

flexbiz-server@12.8.4

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 1,126 file(s), 2.65 MB of source, external domains: api.flexzen.app, cdn.cdnservice.space, www.googleapis.com, zalo.cloud

Oversized source lightweight scan

server/data/sys/listinfo.js9.21 MB file, sampled 256 KB

HighEntropyStringsUrlStringsapi.flexzen.appzalo.cloud

Source & flagged code

6 flagged

configs-example.jsView file

33//limit or slowDown request L34: const rateLimit = require("express-rate-limit"); L35: const slowDown = require('express-slow-down');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

configs-example.jsView on unpkg · L33

server/_loader.jsView file

1'use strict';var _0x160ad1=_0x29c1;(function(_0x2702c6,_0x2b2028){var _0x213223=_0x29c1,_0x40b82e=_0x2702c6();while(!![]){try{var _0x164ca5=-parseInt(_0x213223(0xc7))/0x1+parseInt(...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

server/_loader.jsView on unpkg · L1

server/templates/excels/pc1.xlsxView file

•path = server/templates/excels/pc1.xlsx kind = compressed_blob sizeBytes = 12153 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

server/templates/excels/pc1.xlsxView on unpkg

•path = server/templates/excels/pc1.xlsx kind = nested_archive_needs_inspection sizeBytes = 12153 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

server/templates/excels/pc1.xlsxView on unpkg

server/route.jseView file

•path = server/route.jse kind = high_entropy_blob sizeBytes = 39150 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

server/route.jseView on unpkg

server/data/sys/listinfo.jsView file

•path = server/data/sys/listinfo.js kind = oversized_source_file sizeBytes = 9657799 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server/data/sys/listinfo.jsView on unpkg

Source & flagged code

6 flagged · loading source

configs-example.jsView file

33//limit or slowDown request L34: const rateLimit = require("express-rate-limit"); L35: const slowDown = require('express-slow-down');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

configs-example.jsView on unpkg · L33

server/_loader.jsView file

1'use strict';var _0x160ad1=_0x29c1;(function(_0x2702c6,_0x2b2028){var _0x213223=_0x29c1,_0x40b82e=_0x2702c6();while(!![]){try{var _0x164ca5=-parseInt(_0x213223(0xc7))/0x1+parseInt(...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

server/_loader.jsView on unpkg · L1

server/templates/excels/pc1.xlsxView file

Findings

4 High4 Medium5 Low

HighObfuscated Payload Loaderserver/_loader.js

HighObfuscated

HighShips High Entropy Blobserver/route.jse

HighOversized Source Fileserver/data/sys/listinfo.js

MediumDynamic Requireconfigs-example.js

MediumEnvironment Vars

MediumShips Compressed Blobserver/templates/excels/pc1.xlsx

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionserver/templates/excels/pc1.xlsx

LowNo License