registry / flujo-ai / 3.22.0

flujo-ai@3.22.0

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 3 file(s), 12.9 KB of source

Source & flagged code

5 flagged

.next/server/chunks/8739.jsView file

Lines 1-2javascript

1"use strict";exports.id=8739,exports.ids=[8739],exports.modules={13516:(a,b,c)=>{c.d(b,{G:()=>d});let d={LOG_LEVEL:3,INCLUDE_TOOL_CALLS_IN_RESPONSE:!0,ENABLE_EXECUTION_TRACKER:!1}},43326:(a,b,c)=>{c.d(b,{JC:()=>f,Ne:()=>j,Sx:()=>h,ok:()=>g,v0:()=>i});var d=c(33873),e=c.n(d);function f(){return process.cwd()}function g(){let a=process.env.FLUJO_DATA_DIR;return a&&a.trim().length>0?e().resolve(a):f()}function h(){let a=process.env.FLUJO_OLLAMA_URL;return(a&&a.trim().length>0?a.trim():"http://localhost:11434").replace(/\/+$/,"")}function i(){let a=process.env.FLUJO_OLLAMA;return"1"===a||"true"=== ...

2${b}`}catch(a){i+=": [Object cannot be stringified]"}else i+=`: ${d}`;switch(a){case e.VERBOSE:console.debug(`[VERBOSE] ${i}`);break;case e.DEBUG:console.debug(i);break;case e.INFO:console.info(i);break;case e.WARN:console.warn(i);break;case e.ERROR:console.error(i);break;default:console.log(i)}}}function i(a,b){let c,d=((c=a.replace(/^src\//,"")).startsWith("/")&&(c=c.substring(1)),c);return{verbose:(a,c)=>{h(e.VERBOSE,d,a,c,b)},debug:(a,c)=>{h(e.DEBUG,d,a,c,b)},info:(a,c)=>{h(e.INFO,d,a,c,b)},warn:(a,c)=>{h(e.WARN,d,a,c,b)},error:(a,c)=>{h(e.ERROR,d,a,c,b)}}}},58739:(a,b,c)=>{c.r(b),c.d(b,{E ...

Medium

Secret Pattern

Package contains a possible secret pattern.

.next/server/chunks/8739.jsView on unpkg · L2

Long lines were clipped for display.

bin/flujo.mjsView file

Lines 6-46javascript

6 * local `next build`. It:

7 * 1. Puts user data in ~/.flujo by default (FLUJO_DATA_DIR override honored),

8 * so nothing is written into the read-only package install dir.

.next/static/media/013b72fa676f92e0-s.woff2View file

•path = .[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 6204 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/013b72fa676f92e0-s.woff2View on unpkg

.next/server/chunks/7362.jsView file

•path = .next/server/chunks/7362.js kind = payload_in_excluded_dir sizeBytes = 2104775 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/server/chunks/7362.jsView on unpkg

•path = .next/server/chunks/7362.js kind = oversized_source_file sizeBytes = 2104775 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next/server/chunks/7362.jsView on unpkg

Source & flagged code

5 flagged · loading source

.next/server/chunks/8739.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = ${b}`}ca...}}};

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code