registry / hfs / 3.2.1

hfs@3.2.1

⚠ Under review

HTTP File Server

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

CopyleftLicenseWildcardDependency

scanned 235 file(s), 2.74 MB of source, external domains: api.github.com, bit.ly, developer.mozilla.org, download.ip2location.com, fb.me, github.com, google.com, mui.com, npms.io, raw.githubusercontent.com, reactjs.org, rejetto.com, upload.wikimedia.org, www.gnu.org, www.w3.org

Source & flagged code

4 flagged

src/plugins.jsView file

Lines 379-419javascript

379 await this.data?.unload?.();

380 }

381 catch (e) {

382 console.log('Error unloading plugin', id, String(e));

383 }

384 await this.onUnload();

385 if (!reloading && id !== exports.SERVER_CODE_ID) // we already printed 'reloading'

386 console.log('Unloaded plugin', id);

387 if (this.data)

388 this.data.unload = undefined;

389 }

390}

391exports.Plugin = Plugin;

392exports.SERVER_CODE_ID = '.'; // a name that will surely be not found among plugin folders

393const serverCode = (0, config_1.defineConfig)('server_code', '', async (script, { k }) => {

394 try {

395 (await serverCode.compiled())?.unload();

396 }

397 catch { }

398 const res = {};

399 try {

400 new Function('exports,require', script)(res, require); // parse

401 await initPlugin(res);

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/plugins.jsView on unpkg · L399

402 res.getCustomHtml = () => (0, misc_1.callable)(res.customHtml) || {};

403 return new Plugin(exports.SERVER_CODE_ID, '', res, lodash_1.default.noop);

404 }

405 catch (e) {

406 return console.error(k + ':', e.message || String(e));

407 }

408});

409function mapPlugins(cb, includeServerCode = true) {

410 let i = 0;

411 return Array.from(plugins).map(([plName, pl]) => {

412 if (!includeServerCode && plName === exports.SERVER_CODE_ID)

413 return;

414 try {

415 return cb(pl, plName, i++);

416 }

417 catch (e) {

418 console.log('Plugin error', plName, String(e));

419 }

frontend/assets/polyfills-legacy-uhvhjQSD.jsView file

Lines 1-1javascript

1!function(){function e(e,t){return(t||"")+" (SystemJS https://github.com/systemjs/systemjs/blob/main/docs/errors.md#"+e+")"}function t(e,t){if(-1!==e.indexOf("\\

admin/assets/index-D2UH6ajh.jsView file

147contains invisible/control Unicode U+200B (zero width space) `),a=t.selectionStart===r;i&&a&&t.setSelectionRange(r,r),n&&n(e)},ref:u,rows:i,style:a},s)),(0,K.jsx)(`textarea`,{"aria-hidden":!0,className:e.className,readOnly:!0,ref:f,tabIndex:-1,style:H(H(H({},rm.shadow),a),{},{paddingTop:0,paddingBott

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

admin/assets/index-D2UH6ajh.jsView on unpkg · L147

frontend/fontello.woff2View file

•path = frontend/fontello.woff2 kind = high_entropy_blob sizeBytes = 9240 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend/fontello.woff2View on unpkg

Source & flagged code

4 flagged · loading source

src/plugins.jsView file

399try { L400: new Function('exports,require', script)(res, require); // parse L401: await initPlugin(res);

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/plugins.jsView on unpkg · L399

frontend/assets/polyfills-legacy-uhvhjQSD.jsView file

1!function(){function e(e,t){return(t||"")+" (SystemJS https://github.[redacted].md#"+e+")"}function t(e,t){if(-1!==e.indexOf("\\")&&(e=e.replace(S,...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

frontend/assets/polyfills-legacy-uhvhjQSD.jsView on unpkg · L1

admin/assets/index-D2UH6ajh.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

admin/assets/index-D2UH6ajh.jsView on unpkg · L147

frontend/fontello.woff2View file

•path = frontend/fontello.woff2 kind = high_entropy_blob sizeBytes = 9240 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend/fontello.woff2View on unpkg

Findings

1 Critical1 High5 Medium7 Low

CriticalTrojan Source Unicodeadmin/assets/index-D2UH6ajh.js

HighShips High Entropy Blobfrontend/fontello.woff2

MediumDynamic Requirefrontend/assets/polyfills-legacy-uhvhjQSD.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvalsrc/plugins.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

4 flagged

src/plugins.jsView file

Lines 379-419javascript

379 await this.data?.unload?.();

380 }

381 catch (e) {

382 console.log('Error unloading plugin', id, String(e));

383 }

384 await this.onUnload();

385 if (!reloading && id !== exports.SERVER_CODE_ID) // we already printed 'reloading'

386 console.log('Unloaded plugin', id);

387 if (this.data)

388 this.data.unload = undefined;

389 }

390}

391exports.Plugin = Plugin;

392exports.SERVER_CODE_ID = '.'; // a name that will surely be not found among plugin folders

393const serverCode = (0, config_1.defineConfig)('server_code', '', async (script, { k }) => {

394 try {

395 (await serverCode.compiled())?.unload();

396 }

397 catch { }

398 const res = {};

399 try {

400 new Function('exports,require', script)(res, require); // parse

401 await initPlugin(res);

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/plugins.jsView on unpkg · L399

402 res.getCustomHtml = () => (0, misc_1.callable)(res.customHtml) || {};

403 return new Plugin(exports.SERVER_CODE_ID, '', res, lodash_1.default.noop);

404 }

405 catch (e) {

406 return console.error(k + ':', e.message || String(e));

407 }

408});

409function mapPlugins(cb, includeServerCode = true) {

410 let i = 0;

411 return Array.from(plugins).map(([plName, pl]) => {

412 if (!includeServerCode && plName === exports.SERVER_CODE_ID)

413 return;

414 try {

415 return cb(pl, plName, i++);

416 }

417 catch (e) {

418 console.log('Plugin error', plName, String(e));

419 }

frontend/assets/polyfills-legacy-uhvhjQSD.jsView file

Lines 1-1javascript

1!function(){function e(e,t){return(t||"")+" (SystemJS https://github.com/systemjs/systemjs/blob/main/docs/errors.md#"+e+")"}function t(e,t){if(-1!==e.indexOf("\\

admin/assets/index-D2UH6ajh.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

admin/assets/index-D2UH6ajh.jsView on unpkg · L147

frontend/fontello.woff2View file

•path = frontend/fontello.woff2 kind = high_entropy_blob sizeBytes = 9240 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend/fontello.woff2View on unpkg