registry / kresus / 0.25.1

kresus@0.25.1

Kresus' Personal Finance Manager

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 119 file(s), 1.91 MB of source, external domains: bit.ly, codeberg.org, eslint.org, expressjs.com, fontawesome.io, fsf.org, github.com, kresus.org, lodash.com, log4js-node.github.io, mochajs.org, momentjs.com, necolas.github.io, nodemailer.com, prettier.io, primer.github.io, react.dev, reactrouter.com, redux-toolkit.js.org, redux.js.org, rolldown.rs, stylelint.io, thenounproject.com, typeorm.io, typescript-eslint.io, typestrong.org, vite.dev, woob.tech, www.chartjs.org, www.typescriptlang.org, www.w3.org

Source & flagged code

4 flagged

support/docker-compose/.envView file

3patternName = blocked_file severity = critical matchedText = support/docker-compose/.env redactedSecretContext = secretLikeLines = 2 L3: PASSWORD_HASH=<redacted:37 token-like> L11: EMAIL_PASSWORD=<redacted:0 empty>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

support/docker-compose/.envView on unpkg · L3

bin/kresus.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/* eslint no-console: 0 */

4/* eslint no-process-exit: 0 */

5/* eslint import/no-dynamic-require: 0 */

7let path = require('path');

8let fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kresus.jsView on unpkg · L6

9let ini = require('ini');

11function help(binaryName) {

12 console.log(

13 `Usage: ${binaryName}\n` +

14 '\t-h or --help or help: displays this message.\n' +

15 '\t-c $path or --config $path: path to the configuration file.\n' +

16 '\tcreate:config: creates an empty configuration file up to date.\n' +

17 '\tcreate:user $login [--admin]: creates a new user with given login,\n' +

18 '\t\tand assigns it an ID. Pass "--admin" to create an administrator.\n' +

19 '\tdelete:user $login: deletes a user with given login\n' +

20 '\tlist:users: lists all the users with their id, login and admin status.'

21 );

22}

24let explainedChmodError = false;

25function tryChmod(pathname, mode) {

26 try {

support/docker/entrypoint.shView file

•path = support/docker/entrypoint.sh kind = build_helper sizeBytes = 949 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

support/docker/entrypoint.shView on unpkg

build/client/assets/OpenSans-Light-DPlZYt4w.woffView file

•path = build/client/assets/OpenSans-Light-DPlZYt4w.woff kind = high_entropy_blob sizeBytes = 62844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/assets/OpenSans-Light-DPlZYt4w.woffView on unpkg

Source & flagged code

4 flagged · loading source

support/docker-compose/.envView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

support/docker-compose/.envView on unpkg · L3

bin/kresus.jsView file

6L7: let path = require('path'); L8: let fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kresus.jsView on unpkg · L6

support/docker/entrypoint.shView file

•path = support/docker/entrypoint.sh kind = build_helper sizeBytes = 949 magicHex = [redacted]

Findings

1 Critical1 High5 Medium5 Low

CriticalCritical Secretsupport/docker-compose/.env

HighShips High Entropy Blobbuild/client/assets/OpenSans-Light-DPlZYt4w.woff

MediumDynamic Requirebin/kresus.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersupport/docker/entrypoint.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License