registry / hypertube-binaries / 3.1.2

hypertube-binaries@3.1.2

Hypertube allows you to reference and use modules or packages written in (Java/Kotlin/Groovy/Clojure, C#/VB.NET, Ruby, Perl, Python, JavaScript/TypeScript) like they were created in your technology. It works on Linux/Windows and MacOS for applications cre

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNativeBindingsShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 12.0 KB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 1-31json

2 "name": "hypertube-binaries",

3 "version": "3.1.2",

4 "description": "Hypertube allows you to reference and use modules or packages written in (Java/Kotlin/Groovy/Clojure, C#/VB.NET, Ruby, Perl, Python, JavaScript/TypeScript) like they were created in your technology. It works on Linux/Windows and MacOS for applications created in JVM, CLR/Netcore, Perl, Python, Ruby, NodeJS, C++ or GoLang and gives you unparalleled freedom and flexibility with native performance in building your mixed-technologies products. Let it be accessing best AI or cryptography libraries, devices SDKs, legacy client modules, internal custom packages or anything from pu ...

5 "main": "index.js",

6 "type": "commonjs",

7 "keywords": [],

8 "author": "Graftcode S.A.",

9 "license": "ISC",

10 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L10

11 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "prebuild": "node-gyp rebuild",

13 "build:win32": "node-gyp rebuild --target_arch=x64",

14 "build:win32:arm64": "node-gyp rebuild --target_arch=arm64",

15 "build:linux": "node-gyp rebuild --target_arch=x64",

16 "build:linux:arm64": "node-gyp rebuild --target_arch=arm64",

17 "build:darwin": "node-gyp rebuild --target_arch=x64",

18 "build:darwin:arm64": "node-gyp rebuild --target_arch=arm64",

19 "package:prebuild": "node scripts/package-prebuild.js",

20 "verify": "node scripts/verify-prebuild.js"

21 },

22 "os": [

23 "win32",

24 "linux",

25 "darwin"

26 ],

27 "cpu": [

28 "x64",

29 "arm64"

30 ]

31}

Long lines were clipped for display.

index.jsView file

Lines 1-21javascript

1const path = require('path');

2const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

3const

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView file

•path = [redacted].dylib kind = native_binary sizeBytes = 277240 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 154 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Binaries/Jvm/HypertubeJvmRuntime.jarView file

•path = [redacted].jar kind = high_entropy_blob sizeBytes = 5660435 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

•path = [redacted].jar kind = compressed_blob sizeBytes = 5660435 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

•path = [redacted].jar kind = nested_archive_needs_inspection sizeBytes = 5660435 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts registry_only=install

Critical

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code