registry / galactic.ts / 2.1.6

galactic.ts@2.1.6

galactic is a scalable clustering and sharding framework for Discord bots, enabling efficient multi-machine deployments with seamless discord.js integration.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 93.2 KB of source

Source & flagged code

1 flagged

dist/index.cjsView file

Lines 787-827javascript

787 });

788 this.client.shard?.fetchClientValues("uptime", shard.id).then((values) => {

789 shardPings[shard.id]["uptime"] = values;

790 }).catch((e) => {});

791 });

792 } catch (_) {}

793 return {

794 cpu: {

795 raw: process.cpuUsage(),

796 cpuPercent: cpuPercent.toFixed(2)

797 },

798 memory: {

799 raw: process.memoryUsage(),

800 memoryPercent: (process.memoryUsage().heapUsed / process.memoryUsage().heapTotal * 100).toFixed(2) + "%",

801 usage: (process.memoryUsage().heapUsed / 1024 / 1024).toFixed(2) + "MB"

802 },

803 ping: this.client.ws.ping,

804 shardPings

805 };

806 } else if (m.type == "BROADCAST_EVAL") {

807 const broadcast = message;

808 const fn = eval(`(${broadcast.data})`);

809 const result = fn(this.client);

High

Eval

Package source references dynamic code evaluation.

dist/index.cjsView on unpkg · L807

810 if (result instanceof Promise) return new Promise((resolve, reject) => {

811 result.then((res) => {

812 resolve(res);

813 }).catch((err) => {

814 reject(err);

815 });

816 });

817 else return result;

818 } else if (m.type == "SELF_DESTRUCT") return new Promise(async (resolve) => {

819 if (!this._shuttingDown) {

820 this._shuttingDown = true;

821 if (this.onSelfDestruct) await Promise.resolve(this.onSelfDestruct());

822 if (this.client) try {

823 this.client.destroy();

824 } catch {}

825 }

826 resolve();

827 process.exit(0);

Source & flagged code

1 flagged · loading source

dist/index.cjsView file

807const broadcast = message; L808: const fn = eval(`(${broadcast.data})`); L809: const result = fn(this.client);

High

Eval

Package source references dynamic code evaluation.

dist/index.cjsView on unpkg · L807

Findings

1 High1 Medium1 Low

HighEvaldist/index.cjs

MediumEnvironment Vars

LowScripts Present

Source & flagged code

1 flagged

dist/index.cjsView file

Lines 787-827javascript

787 });

788 this.client.shard?.fetchClientValues("uptime", shard.id).then((values) => {

789 shardPings[shard.id]["uptime"] = values;

790 }).catch((e) => {});

791 });

792 } catch (_) {}

793 return {

794 cpu: {

795 raw: process.cpuUsage(),

796 cpuPercent: cpuPercent.toFixed(2)

797 },

798 memory: {

799 raw: process.memoryUsage(),

800 memoryPercent: (process.memoryUsage().heapUsed / process.memoryUsage().heapTotal * 100).toFixed(2) + "%",

801 usage: (process.memoryUsage().heapUsed / 1024 / 1024).toFixed(2) + "MB"

802 },

803 ping: this.client.ws.ping,

804 shardPings

805 };

806 } else if (m.type == "BROADCAST_EVAL") {

807 const broadcast = message;

808 const fn = eval(`(${broadcast.data})`);

809 const result = fn(this.client);

High

Eval

Package source references dynamic code evaluation.

dist/index.cjsView on unpkg · L807

810 if (result instanceof Promise) return new Promise((resolve, reject) => {

811 result.then((res) => {

812 resolve(res);

813 }).catch((err) => {

814 reject(err);

815 });

816 });

817 else return result;

818 } else if (m.type == "SELF_DESTRUCT") return new Promise(async (resolve) => {

819 if (!this._shuttingDown) {

820 this._shuttingDown = true;

821 if (this.onSelfDestruct) await Promise.resolve(this.onSelfDestruct());

822 if (this.client) try {

823 this.client.destroy();

824 } catch {}

825 }

826 resolve();

827 process.exit(0);