registry / hwjcode / 1.1.78

hwjcode@1.1.78

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 263 KB of source, external domains: aistudio.google.com, api-code.deepvlab.ai, feross.org, github.com, goo.gle, jimmy.warting.se, mths.be, open.feishu.cn, react.dev, sheetjs.com, www.apache.org

Oversized source lightweight scan

bundle/easycode.js20.7 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsaistudio.google.comapi-code.deepvlab.aifeross.orggithub.comgoo.glejimmy.warting.semths.beopen.feishu.cnreact.devsheetjs.comwww.apache.org

Source & flagged code

4 flagged

package.jsonView file

Lines 73-113json

73 "package": "npm run package --workspace=packages/vscode-ui-plugin",

74 "pack:vscode": "npm run package --workspace=packages/vscode-ui-plugin && copy packages\\vscode-ui-plugin\\*.vsix .",

75 "test": "npm run test --workspaces",

76 "test:ci": "npm run test:ci --workspaces --if-present && npm run test:scripts",

77 "test:scripts": "vitest run --config ./scripts/tests/vitest.config.ts",

78 "test:e2e": "npm run test:integration:sandbox:none -- --verbose --keep-output",

79 "test:integration:all": "npm run test:integration:sandbox:none && npm run test:integration:sandbox:docker && npm run test:integration:sandbox:podman",

80 "test:integration:sandbox:none": "GEMINI_SANDBOX=false node integration-tests/run-tests.js",

81 "test:integration:sandbox:docker": "GEMINI_SANDBOX=docker node integration-tests/run-tests.js",

82 "test:integration:sandbox:podman": "GEMINI_SANDBOX=podman node integration-tests/run-tests.js",

83 "lint": "eslint . --ext .ts,.tsx && eslint integration-tests",

84 "lint:fix": "eslint . --fix && eslint integration-tests --fix",

85 "lint:ci": "eslint . --ext .ts,.tsx --max-warnings 0 && eslint integration-tests --max-warnings 0",

86 "format": "prettier --write .",

87 "typecheck": "npm run typecheck --workspaces --if-present",

88 "preflight": "npm run clean && npm ci && npm run format && npm run lint:ci && npm run build && npm run typecheck && npm run test:ci",

89 "prepare": "node scripts/prepare.js",

90 "prepublishOnly": "node scripts/prepare-publish.js && cross-env BUILD_ENV=production NPM_PUBLISH_MODE=1 npm run bundle:prod",

91 "postpublish": "node scripts/restore-after-publish.js",

92 "prepare:package": "node scripts/prepare-package.js",

93 "postinstall": "node -e \"const fs = require('fs'); const path = 'bundle/fix-binary-permissions.js'; if (fs.existsSync(path)) { require('child_process').execSync('node ' + path + ' --all', {stdio: 'inherit'}); } else { console.log('⏭️ Skipping binary permissions fix (bundle not built yet)'); }\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 "release:version": "node scripts/version.js",

95 "telemetry": "node scripts/telemetry.js",

96 "clean": "node scripts/clean.js",

97 "env:production": "./scripts/switch-env.sh production",

98 "env:development": "./scripts/switch-env.sh development",

99 "env:test": "./scripts/switch-env.sh test"

100 },

101 "bin": {

102 "hwjcode": "bundle/easycode.js"

103 },

104 "preferGlobal": true,

105 "files": [

106 "bundle/",

107 "README.md",

108 "LICENSE"

109 ],

110 "devDependencies": {

111 "@testing-library/dom": "^10.4.1",

112 "@testing-library/react": "^16.3.1",

113 "@types/fs-extra": "^11.0.4",

bundle/easycode.jsView file

•path = bundle/easycode.js kind = oversized_source_file sizeBytes = 21756409 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/easycode.jsView on unpkg

•path = bundle/easycode.js kind = oversized_cli_entrypoint sizeBytes = 21756409 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/easycode.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs = require('fs'); const path = 'bundle/fix-binary-permissions.js'; if (fs.existsSync(path)) { require('child_process').execSync('node ' + path + ' --all', {stdio: ...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bundle/easycode.jsView file

•path = bundle/easycode.js kind = oversized_source_file sizeBytes = 21756409 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/easycode.jsView on unpkg

•path = bundle/easycode.js kind = oversized_cli_entrypoint sizeBytes = 21756409 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/easycode.jsView on unpkg

Findings

2 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filebundle/easycode.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointbundle/easycode.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings