registry / github-issue-tower-defence-management / 1.125.2

github-issue-tower-defence-management@1.125.2

⚠ Under review

[![Test](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/actions/workflows/test.yml/badge.svg)](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/actions/workflows/test.yml) [![code style: pretti

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 639 file(s), 4.31 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, cdn.jsdelivr.net, console.example.test, docs.google.com, evil-githubusercontent.com, example.com, github.com, i.imgur.com, private-user-images.githubusercontent.com, react.dev, slack.com, www.cisa.gov, www.googleapis.com, www.w3.org

Source & flagged code

3 flagged

bin/adapter/proxy/ensureProxyRunning.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.ensureProxyRunning = void 0;

37const child_process_1 = require("child_process");

38const net = __importStar(require("net"));

High

Child Process

Package source references child process execution.

bin/adapter/proxy/ensureProxyRunning.jsView on unpkg · L36

39const path = __importStar(require("path"));

40const RateLimitCache_1 = require("./RateLimitCache");

41const PROBE_TIMEOUT_MS = 200;

42const STARTUP_WAIT_MS = 1500;

43const isProxyResponding = (port) => new Promise((resolve) => {

44 const socket = new net.Socket();

45 let resolved = false;

46 const cleanup = (result) => {

47 if (resolved)

48 return;

49 resolved = true;

50 socket.destroy();

51 resolve(result);

52 };

53 socket.setTimeout(PROBE_TIMEOUT_MS);

54 socket.once('connect', () => cleanup(true));

55 socket.once('timeout', () => cleanup(false));

56 socket.once('error', () => cleanup(false));

src/adapter/proxy/ensureProxyRunning.tsView file

Lines 1-21typescript

1import { spawn } from 'child_process';

2import * as net from 'net';

3import * as path from 'path'

bin/adapter/entry-points/console/webServer.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = github-issue-tower-defence-management@1.119.4 matchedIdentity = npm:[redacted]:1.119.4 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/adapter/entry-points/console/webServer.jsView on unpkg

Source & flagged code

3 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code