registry  /  fullstx  /  1.0.3

fullstx@1.0.3

⚠ Under review

A high-performance, custom backend framework with built-in hot-reload.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 34 file(s), 1.18 MB of source, external domains: feross.org, github.com, nodejs.org, www.sitemaps.org, yarnpkg.com

Source & flagged code

10 flagged · loading source
dist/index.jsView file
1var wD=Object.create;var kr=Object.defineProperty;var DD=Object.getOwnPropertyDescriptor;var ED=Object.getOwnPropertyNames;var CD=Object.getPrototypeOf,SD=Object.prototype.hasOwnPr... L2: `),this.raw.write(`data: ${typeof t=="object"?JSON.stringify(t):t} L3: L4: `)}redirect(t,n=302){this.raw.writeHead(n,{Location:t}),this.raw.end()}header(t,n){return this.raw.setHeader(t,n),this}cookie(t,n,i={}){let r=`${t}=${encodeURIComponent(n)}`;i.maxA... L5: [x] Missing driver for PostgreSQL.`),console.error(` Please install it by running: npm install pg ... L19: [x] Missing driver for Elasticsearch.`),console.error(` Please install it by running: npm install @elastic/elasticsearch L20: `),process.exit(1)),u}else console.warn(`[!] Unsupported database type: ${r}`);return i&&n.use((u,c,l)=>{u.db=i,l()}),i}});var hp=m((l4,fp)=>{var $D=require("crypto"),Br=class{cons... L21: `).reduce(function(r,a){return Cd(a)>r?Cd(a):r},0)}function _i(e,t){return Array(t+1).join(e)}function vE(e,t,n,i){let r=ht(e);if(t+1>=r){let a=t-r;switch(i){case"right":{e=_i(n,a)... L22: `);let r=n?AE:kE;for(let a=0;a<t.length;a++)i.push.apply(i,r(e,t[a]));return i}function FE(e){let t={},n=[];for(let i=0;i<e.len
Critical
Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L1
49Trigger-reachable chain: manifest.main -> dist/index.js L49: `}return t}};vn.PackedArrayContext=yc;var s0=e=>Number(e).toString(16).padStart(2,"0")});var l0=m(va=>{"use strict";Object.defineProperty(va,"__esModule",{value:!0});va.PackedArray... L50: `;return t+=this.arrayContext.toString(),t}};va.PackedArray=Dc});var Sc=m(Cc=>{"use strict";Object.defineProperty(Cc,"__esModule",{value:!0});var nA=Zn(),iA=l0(),Ec=class e extends... L51: `;t.tag&&t.tag!==EA.NO_TAG?this.log(`Tag=${t.tag},${c}`):this.log(c)}outputComment(t){this.log(`#${t} ... L53: `)}outputLegend(){this.log(`"StartTimestamp","Interval_Length","Interval_Max","Interval_Compressed_Histogram" L54: `)}outputLogFormatVersion(){this.outputComment("[Histogram log format version "+SA+"]")}};Jc.default=Xc});var Kc=m(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0... L55: `+s.toString());let o=new a({head:Fa(r.cyan,["Stat","1%","2.5%","50%","97.5%","Avg","Stdev","Min"])});if(o.push(R0(r.bold("Req/Sec"),QA(e.requests))),o.push(R0(r.bold("Bytes/Sec"),... L56: `}return n};function KA(e,t){return[e,t.p2_5,t.p50,t.p97_5,t.p99,t.average,t.stddev,typeof t.max=="string"?t.max:Math.floor(t.max*100)/100]}function R0(e,t)…
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L49
68`;f(w),r.workers?c():r.amount?s=E6(e,t,r):a=D6(e,t,r),p()}}),e.on("done",d=>{if(t.renderResultsTable===!1)return;let h=b6(d,t);t.outputStream.write(h)});function c(){u=v6()}functio... L69: `)}}function D6(e,t,n){if(!t.outputStream.isTTY)return;let i=new S1(t.progressBarString,{width:20,incomplete:" ",total:n.duration,clear:!0,stream:t.outputStream});return i.tick(0),... L70: `:p.startsWith("og:")||p.startsWith("twitter:")?l+=`<meta property="${p}" content="${f}">
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L68
49`}return t}};vn.PackedArrayContext=yc;var s0=e=>Number(e).toString(16).padStart(2,"0")});var l0=m(va=>{"use strict";Object.defineProperty(va,"__esModule",{value:!0});va.PackedArray... L50: `;return t+=this.arrayContext.toString(),t}};va.PackedArray=Dc});var Sc=m(Cc=>{"use strict";Object.defineProperty(Cc,"__esModule",{value:!0});var nA=Zn(),iA=l0(),Ec=class e extends... L51: `;t.tag&&t.tag!==EA.NO_TAG?this.log(`Tag=${t.tag},${c}`):this.log(c)}outputComment(t){this.log(`#${t}
High
Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L49
49`}return t}};vn.PackedArrayContext=yc;var s0=e=>Number(e).toString(16).padStart(2,"0")});var l0=m(va=>{"use strict";Object.defineProperty(va,"__esModule",{value:!0});va.PackedArray... L50: `;return t+=this.arrayContext.toString(),t}};va.PackedArray=Dc});var Sc=m(Cc=>{"use strict";Object.defineProperty(Cc,"__esModule",{value:!0});var nA=Zn(),iA=l0(),Ec=class e extends... L51: `;t.tag&&t.tag!==EA.NO_TAG?this.log(`Tag=${t.tag},${c}`):this.log(c)}outputComment(t){this.log(`#${t} ... L55: `+s.toString());let o=new a({head:Fa(r.cyan,["Stat","1%","2.5%","50%","97.5%","Avg","Stdev","Min"])});if(o.push(R0(r.bold("Req/Sec"),QA(e.requests))),o.push(R0(r.bold("Bytes/Sec"),... L56: `}return n};function KA(e,t){return[e,t.p2_5,t.p50,t.p97_5,t.p99,t.average,t.stddev,typeof t.max=="string"?t.max:Math.floor(t.max*100)/100]}function R0(e,t){return[e,t.p1,t.p2_5,t.... L57: `;ae.DEFAULT_CONTENT_TYPE="application/octet-stream";ae.prototype.append=function(e,t,n){n=n||{},typeof n=="string"&&(n={filename:n});var i=ku.prototype.append.bind(this);if((typeo... L58: `));return s;function s(){let o;return a===i&&(s.uuid=Jy(),r=Ky(s.uuid,n),a=0),t?o=r+`0000000000${a}`.slice(-10):o=r+a,a=a+1|0,o}}function
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L49
49`}return t}};vn.PackedArrayContext=yc;var s0=e=>Number(e).toString(16).padStart(2,"0")});var l0=m(va=>{"use strict";Object.defineProperty(va,"__esModule",{value:!0});va.PackedArray... L50: `;return t+=this.arrayContext.toString(),t}};va.PackedArray=Dc});var Sc=m(Cc=>{"use strict";Object.defineProperty(Cc,"__esModule",{value:!0});var nA=Zn(),iA=l0(),Ec=class e extends... L51: `;t.tag&&t.tag!==EA.NO_TAG?this.log(`Tag=${t.tag},${c}`):this.log(c)}outputComment(t){this.log(`#${t} ... L53: `)}outputLegend(){this.log(`"StartTimestamp","Interval_Length","Interval_Max","Interval_Compressed_Histogram" L54: `)}outputLogFormatVersion(){this.outputComment("[Histogram log format version "+SA+"]")}};Jc.default=Xc});var Kc=m(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0... L55: `+s.toString());let o=new a({head:Fa(r.cyan,["Stat","1%","2.5%","50%","97.5%","Avg","Stdev","Min"])});if(o.push(R0(r.bold("Req/Sec"),QA(e.requests))),o.push(R0(r.bold("Bytes/Sec"),... L56: `}return n};function KA(e,t){return[e,t.p2_5,t.p50,t.p97_5,t.p99,t.average,t.stddev,typeof t.max=="string"?t.max:Math.floor(t.max*100)/100]}function R0(e,t){return[e,t.p1,t.p2_5,t.... L57: `;ae.DEFAULT_CONTENT_TYP
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L49
1var wD=Object.create;var kr=Object.defineProperty;var DD=Object.getOwnPropertyDescriptor;var ED=Object.getOwnPropertyNames;var CD=Object.getPrototypeOf,SD=Object.prototype.hasOwnPr... L2: `),this.raw.write(`data: ${typeof t=="object"?JSON.stringify(t):t} L3: L4: `)}redirect(t,n=302){this.raw.writeHead(n,{Location:t}),this.raw.end()}header(t,n){return this.raw.setHeader(t,n),this}cookie(t,n,i={}){let r=`${t}=${encodeURIComponent(n)}`;i.maxA... L5: [x] Missing driver for PostgreSQL.`),console.error(` Please install it by running: npm install pg ... L19: [x] Missing driver for Elasticsearch.`),console.error(` Please install it by running: npm install @elastic/elasticsearch L20: `),process.exit(1)),u}else console.warn(`[!] Unsupported database type: ${r}`);return i&&n.use((u,c,l)=>{u.db=i,l()}),i}});var hp=m((l4,fp)=>{var $D=require("crypto"),Br=class{cons... L21: `).reduce(function(r,a){return Cd(a)>r?Cd(a):r},0)}function _i(e,t){return Array(t+1).join(e)}function vE(e,t,n,i){let r=ht(e);if(t+1>=r){let a=t-r;switch(i){case"right":{e=_i(n,a)... L22: `);let r=n?AE:kE;for(let a=0;a<t.length;a++)i.push.apply(i,r(e,t[a]));return i}function FE(e){let t={},n=[];for(let i=0;i<e.len
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1
bin/generate.jsView file
1const fs = require('fs'); L2: const path = require('path');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/generate.jsView on unpkg · L1
dist/index.mjsView file
1Cross-file remote execution chain: dist/index.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L1: var Ms=Object.defineProperty;var vD=Object.getOwnPropertyDescriptor;var bD=Object.getOwnPropertyNames;var yD=Object.prototype.hasOwnProperty;var A=(e=>typeof require<"u"?require:ty... L2: `),this.raw.write(`data: ${typeof t=="object"?JSON.stringify(t):t} L3: L4: `)}redirect(t,n=302){this.raw.writeHead(n,{Location:t}),this.raw.end()}header(t,n){return this.raw.setHeader(t,n),this}cookie(t,n,i={}){let r=`${t}=${encodeURIComponent(n)}`;i.maxA... L5: [x] Missing driver for PostgreSQL.`),console.error(` Please install it by running: npm install pg ... L19: [x] Missing driver for Elasticsearch.`),console.error(` Please install it by running: npm install @elastic/elasticsearch L20: `),process.exit(1)),u}else console.warn(`[!] Unsupported database type: ${r}`);return i&&n.use((u,c,l)=>{u.db=i,l()}),i}});var dp=m((l4,pp)=>{var YD=A("crypto"),Or=class{constructo... L21: `).reduce(function(r,a){return Dd(a)>r?Dd(a):r},0)}function _i(e,t){return Array(t+1).join(e)}function hE(e,t,n,i){let r=mt(e);if(t+1>=r){let a=t-r;switch(i){case"right":{e=_i(n,a)...…
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L1
package.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Findings

3 Critical7 High4 Medium4 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalManifest Confusionpackage.json
HighChild Processdist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighCross File Remote Execution Contextdist/index.mjs
HighObfuscated
MediumDynamic Requirebin/generate.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings