registry / flujo-ai / 3.12.0

flujo-ai@3.12.0

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 3 file(s), 12.3 KB of source

Source & flagged code

4 flagged

.next/server/chunks/8739.jsView file

Lines 1-2javascript

1"use strict";exports.id=8739,exports.ids=[8739],exports.modules={13516:(a,b,c)=>{c.d(b,{G:()=>d});let d={LOG_LEVEL:3,INCLUDE_TOOL_CALLS_IN_RESPONSE:!0,ENABLE_EXECUTION_TRACKER:!1}},43326:(a,b,c)=>{c.d(b,{JC:()=>f,Ne:()=>h,ok:()=>g});var d=c(33873),e=c.n(d);function f(){return process.cwd()}function g(){let a=process.env.FLUJO_DATA_DIR;return a&&a.trim().length>0?e().resolve(a):f()}function h(){return process.env.FLUJO_CONTAINER?"container":process.env.FLUJO_NPM?"npm":"git"}},46480:(a,b,c)=>{c.d(b,{Z:()=>d});var d=function(a){return a.MODELS="models",a.FLOWS="flows",a.CHAT_HISTORY="history",a.T ...

2${b}`}catch(a){i+=": [Object cannot be stringified]"}else i+=`: ${d}`;switch(a){case e.VERBOSE:console.debug(`[VERBOSE] ${i}`);break;case e.DEBUG:console.debug(i);break;case e.INFO:console.info(i);break;case e.WARN:console.warn(i);break;case e.ERROR:console.error(i);break;default:console.log(i)}}}function i(a,b){let c,d=((c=a.replace(/^src\//,"")).startsWith("/")&&(c=c.substring(1)),c);return{verbose:(a,c)=>{h(e.VERBOSE,d,a,c,b)},debug:(a,c)=>{h(e.DEBUG,d,a,c,b)},info:(a,c)=>{h(e.INFO,d,a,c,b)},warn:(a,c)=>{h(e.WARN,d,a,c,b)},error:(a,c)=>{h(e.ERROR,d,a,c,b)}}}},58739:(a,b,c)=>{c.r(b),c.d(b,{E ...

Medium

Secret Pattern

Package contains a possible secret pattern.

.next/server/chunks/8739.jsView on unpkg · L2

Long lines were clipped for display.

bin/flujo.mjsView file

Lines 6-46javascript

6 * local `next build`. It:

7 * 1. Puts user data in ~/.flujo by default (FLUJO_DATA_DIR override honored),

8 * so nothing is written into the read-only package install dir.

9 * 2. Marks the install mode as 'npm' (FLUJO_NPM

.next/static/media/013b72fa676f92e0-s.woff2View file

•path = .[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 6204 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/013b72fa676f92e0-s.woff2View on unpkg

scripts/launch-next.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = flujo-ai@3.11.0 matchedIdentity = npm:Zmx1am8tYWk:3.11.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/launch-next.mjsView on unpkg

Source & flagged code

4 flagged · loading source

.next/server/chunks/8739.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = ${b}`}ca...}}};

Medium

Secret Pattern

Package contains a possible secret pattern.

.next/server/chunks/8739.jsView on unpkg · L2

bin/flujo.mjsView file

26L27: const require = createRequire(import.meta.url); L28: const __dirname = path.dirname(fileURLToPath(import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/flujo.mjsView on unpkg · L26

.next/static/media/013b72fa676f92e0-s.woff2View file

•path = .[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 6204 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/013b72fa676f92e0-s.woff2View on unpkg

scripts/launch-next.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/launch-next.mjsView on unpkg

Findings

2 High4 Medium5 Low

HighShips High Entropy Blob.next/static/media/013b72fa676f92e0-s.woff2

HighPrevious Version Dangerous Deltascripts/launch-next.mjs

MediumSecret Pattern.next/server/chunks/8739.js

MediumDynamic Requirebin/flujo.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

4 flagged

.next/server/chunks/8739.jsView file

Lines 1-2javascript

Medium

Secret Pattern

Package contains a possible secret pattern.

.next/server/chunks/8739.jsView on unpkg · L2

Long lines were clipped for display.

bin/flujo.mjsView file

Lines 6-46javascript

6 * local `next build`. It:

7 * 1. Puts user data in ~/.flujo by default (FLUJO_DATA_DIR override honored),

8 * so nothing is written into the read-only package install dir.

9 * 2. Marks the install mode as 'npm' (FLUJO_NPM

.next/static/media/013b72fa676f92e0-s.woff2View file

•path = .[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 6204 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/013b72fa676f92e0-s.woff2View on unpkg

scripts/launch-next.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/launch-next.mjsView on unpkg