registry / investing / 0.1.114

investing@0.1.114

⚠ Under review

Reusable investment utilities, trading agents, and financial data tools

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 86.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 3.40 MB of source, external domains: apac.smith.langchain.com, api.alpaca.markets, api.anthropic.com, api.cloudflare.com, api.groq.com, api.openai.com, api.smith.langchain.com, api.tavily.com, app.qwksearch.com, aws.smith.langchain.com, beta.smith.langchain.com, broker-api.alpaca.markets, clob.polymarket.com, data-api.polymarket.com, data.alpaca.markets, data.sec.gov, db.nvstly.com, dev.smith.langchain.com, docs.expo.dev, docs.langchain.com, empty.invalid, eu.smith.langchain.com, finnhub.io, gamma-api.polymarket.com, json-schema.org, mermaid.ink, npms.io, paper-api.alpaca.markets, pine-facade.tradingview.com, polymarketanalytics.com, smith.langchain.com, stream.data.alpaca.markets, stuk.github.io, tiktoken.pages.dev, wikimedia.org, www.sec.gov, www.tradingview.com, www.w3.org, www.zulutrade.com

Source & flagged code

8 flagged

dist/index-CLlAnStL-B7EBGdAY.cjsView file

Lines 1-2javascript

1"use strict";function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e){if(Object.prototype.hasOwnProperty.call(e,"__esModule"))return e;var t=e.default;if("function"==typeof t){var n=function e(){var n=!1;try{n=this instanceof e}catch{}return n?Reflect.construct(t,arguments,this.constructor):t.apply(this,arguments)};n.prototype=t.prototype}else n={};return Object.defineProperty(n,"__esModule",{value:!0}),Object.keys(e).forEach(function(t){var s=Object.getOwnPropertyDescriptor(e,t);Object.defineProperty(n,t,s.get?s:{enumerable:!0,get:funct ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index-CLlAnStL-B7EBGdAY.cjsView on unpkg · L1

Long lines were clipped for display.

dist/archiver-web.es-xMR6Vwo7.jsView file

Lines 1-2javascript

1import{c as e,g as t}from"./index-D3i3mNfo.js";function r(e){throw new Error('Could not dynamically require "'+e+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.')}

dist/index-D3i3mNfo.jsView file

1import{relations as e,eq as t,and as n,desc as r,asc as i,sql as a,gte as o,lte as s}from"drizzle-orm";import c from"xgboost_node";import l from"yahoo-finance2";import u from"doten... L2: CREATE TABLE IF NOT EXISTS ${j.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(j`SELECT id, hash, created_at FROM ${j.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons... L14: return new Map}const nm=df("greeks");function rm(e){return Math.exp(-.5*e*e)/Math.sqrt(2*Math.PI)}function im(e){const t=Math.max(1e-4,Math.min(.9999,e)),n=[-39.69683028665376,220.... L15: return new Set}(0,t.cooldownMinutes),i=n.filter(e=>!r.has(e.id));if(0===i.length)return[];const a=[];for(const c of i)c.tokenYes&&a.push(c.tokenYes),c.tokenNo&&a.push

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index-D3i3mNfo.jsView on unpkg · L1

dist/index-Cigf2mm8.cjsView file

1Trigger-reachable chain: manifest.main -> dist/index.js -> dist/index-Cigf2mm8.cjs L1: "use strict";const e=require("drizzle-orm"),t=require("xgboost_node"),n=require("yahoo-finance2"),r=require("dotenv"),i=require("axios"),a=require("node-fetch");require("predictos"... L2: CREATE TABLE IF NOT EXISTS ${k.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-Cigf2mm8.cjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-Cigf2mm8.cjs: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-Cigf2mm8.cjsView on unpkg

1Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/index-Cigf2mm8.cjs L1: "use strict";const e=require("drizzle-orm"),t=require("xgboost_node"),n=require("yahoo-finance2"),r=require("dotenv"),i=require("axios"),a=require("node-fetch");require("predictos"... L2: CREATE TABLE IF NOT EXISTS ${k.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

dist/index-CLlAnStL-C554ZmGF.jsView file

Lines 1-2javascript

1function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e){

investing@0.1.114

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code