Static Scan Results
scanned 3h ago · by rust-scannerStatic analysis flagged 39 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
32 flagged · loading sourcebin/leerness.jsView file
3333patternName = aws_access_key
severity = critical
line = 3333
matchedText = const fn...b');
Critical
Critical Secret
Package contains a critical-looking secret pattern.
bin/leerness.jsView on unpkg · L3333•matchType = previous_version_dangerous_delta
matchedPackage = leerness@1.35.10
matchedIdentity = npm:bGVlcm5lc3M:1.35.10
similarity = 0.476
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/leerness.jsView on unpkg3333patternName = aws_access_key
severity = critical
line = 3333
matchedText = const fn...b');
Critical
3739patternName = aws_access_key
severity = critical
line = 3739
matchedText = const be...lse;
Critical
3849patternName = aws_access_key
severity = critical
line = 3849
matchedText = return f...true
Critical
3852patternName = aws_access_key
severity = critical
line = 3852
matchedText = && f('AK...alse
Critical
5const path = require('path');
L6: const cp = require('child_process');
L7: const { log, ok, warn, fail, failJson, setQuiet, today, now, absRoot, exists, read, readBuf, mkdirp, writeUtf8, append, rel } = require('../lib/io'); // 1.9.382/383 (UR-0025): 출력/...
High
51try {
L52: const r = cp.spawnSync('chcp.com', [], { encoding: 'utf8', timeout: 2000, shell: true });
L53: const out = (r.stdout || '') + (r.stderr || '');
High
3339{ name: 'MCP notification 준수: id없는 요청 무응답 가드 + ping {} (UR-0049 설치리뷰 1.9.313)', run: () => { const src = read(__filename); const guard = src.includes("const isNotification = !('id'...
L3340: { name: 'PowerShell 감지: pwsh7(channel/Documents\\PowerShell/install) + ps5.1 영구경로 과경고 안함 (UR-0052 설치리뷰 1.9.314)', run: () => { const f = _detectPwshFromEnv; const pwsh7a = f({ POWE...
L3341: { name: 'doc/surface 정합: doctor 명령 + stale MCP 카운트 동적화(commands/banner) (UR-0054 설치리뷰 1.9.315)', run: () => { const src = read(__filename); const doctorOk = typeof doctorCmd === 'f...
L3342: { name: 'drift 마커 버그: session-handoff 프론트매터는 ^--- 일 때만 + drift 최신 Last generated (1.9.316)', run: () => { const src = read(__filename); const scSrc = read(path.join(path.dirname(__...
L3343: { name: '텔레메트리 분리: 내부 auto-call(LEERNESS_INTERNAL) usage 집계 제외 + 주요 spawn 마킹 (UR-0051 설치리뷰 1.9.317)', run: () => { const src = read(__filename); const guard = src.includes("process...
L3344: { name: 'lib/pure-utils: HTML 파싱 유틸 3종 모듈 분리 + 동작 + 인라인 제거 (UR-0025 1.9.318)', run: () => { const m = require('../lib/pure-utils'); const fnOk = typeof m._htmlToText === 'function'...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/leerness.jsView on unpkg · L33395Cross-file remote execution chain: bin/leerness.js spawns scripts/e2e.js; helper contains network access plus dynamic code execution.
L5: const path = require('path');
L6: const cp = require('child_process');
L7: const { log, ok, warn, fail, failJson, setQuiet, today, now, absRoot, exists, read, readBuf, mkdirp, writeUtf8, append, rel } = require('../lib/io'); // 1.9.382/383 (UR-0025): 출력/...
...
L41: // 해결: 부작용을 _cliBootstrap() 으로 묶고 파일 끝 require.main 가드에서만 호출. import/단위테스트는 부작용 0.
L42: // 1.9.249 (UR-0018): 터미널 출력 한국어 깨짐 사전 방지 (stdout UTF-8 + Windows 비-65001 시 chcp 65001 자동, opt-out LEERNESS_NO_AUTOCHCP=1).
L43: function _ensureStdoutEncoding() {
...
L47: } catch {}
L48: if (process.platform !== 'win32') return;
L49: if (process.env.LEERNESS_NO_AUTOCHCP === '1') return;
L50: if (process.env._LEERNESS_CHCP_DONE === '1') return; // 자식 spawn 무한 재호출 방지
...
L71: if (w && (w.code === 'DEP0190' || /DEP0190/.test(String(w.message || '')))) return;
L72: process.stderr.write(`(node:${process.pid}) ${w.name || 'Warning'}: ${w.message || w}\n`);
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/leerness.jsView on unpkg · L52709log(` 🖥 Hardware: ${env.hardware.cpus} CPUs · ${env.hardware.memGB} GB RAM`);
L2710: log(` 🖱 Terminal: TTY=${env.terminal.isTTY}${env.terminal.powershell ? ` · PowerShell v${env.terminal.powershell}` : ''}`);
L2711: log(` 🔧 Tools:`);
...
L2721: // 1.9.254: leerness CLI PATH 자동 등록 (사용자 명시 UR-0019)
L2722: // 배경: `npm i -g leerness` 했는데 npm global bin 이 PATH 에 없으면 `leerness` 명령이 안 먹힘.
L2723: // 해결: global bin 경로 감지 + PATH 포함 여부 확인 → 미등록 시 플랫폼별 안전 등록 (opt-in --apply).
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/leerness.jsView on unpkg · L27093L4: const fs = require('fs');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/leerness.jsView on unpkg · L33095const js = html.slice(html.indexOf(o) + o.length, html.lastIndexOf(c));
L3096: let synOk = false; try { new Function(js); synOk = true; } catch {}
L3097: htmlOk = html.includes('data-v="roadmap"') && html.includes('data-v="toggles"') && html.includes('toggleRegistry') && synOk;
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin/leerness.jsView on unpkg · L3095CHANGELOG.mdView file
646patternName = aws_access_key
severity = critical
line = 646
matchedText = - **FN-g...귀 0.
Critical
2178patternName = aws_access_key
severity = critical
line = 2178
matchedText = - `_isPl... 차단.
Critical
2378patternName = aws_access_key
severity = critical
line = 2378
matchedText = **🔑 `AKI...드.**
Critical
scripts/e2e-core.jsView file
51patternName = aws_access_key
severity = critical
line = 51
matchedText = fs.write...n');
Critical
75patternName = aws_access_key
severity = critical
line = 75
matchedText = fs.write...n');
Critical
scripts/e2e.jsView file
4452patternName = aws_access_key
severity = critical
line = 4452
matchedText = fs.write...8');
Critical
5002patternName = npm_token
severity = critical
line = 5002
matchedText = fs.write...n');
Critical
5421patternName = npm_token
severity = critical
line = 5421
matchedText = fs.write...n');
Critical
5979patternName = github_pat
severity = critical
line = 5979
matchedText = fs.write...;');
Critical
6130patternName = github_pat
severity = critical
line = 6130
matchedText = fs.write...n');
Critical
6130patternName = aws_access_key
severity = critical
line = 6130
matchedText = fs.write...n');
Critical
6137patternName = aws_access_key
severity = critical
line = 6137
matchedText = fs.write...n');
Critical
6144patternName = github_pat
severity = critical
line = 6144
matchedText = fs.write...n');
Critical
6144patternName = aws_access_key
severity = critical
line = 6144
matchedText = fs.write...n');
Critical
6150patternName = aws_access_key
severity = critical
line = 6150
matchedText = fs.write...n');
Critical
6559patternName = aws_access_key
severity = critical
line = 6559
matchedText = fs.write...n');
Critical
6639patternName = aws_access_key
severity = critical
line = 6639
matchedText = fs.write...;');
Critical
6860patternName = private_key_rsa
severity = critical
line = 6860
matchedText = fs.write...n');
Critical
lib/pure-utils.jsView file
705patternName = aws_access_key
severity = critical
line = 705
matchedText = // 1.10....E 등.
Critical
Findings
25 Critical5 High4 Medium5 Low
CriticalCritical Secretbin/leerness.js
CriticalPrevious Version Dangerous Deltabin/leerness.js
CriticalSecret Patternbin/leerness.js
CriticalSecret Patternbin/leerness.js
CriticalSecret Patternbin/leerness.js
CriticalSecret Patternbin/leerness.js
CriticalSecret PatternCHANGELOG.md
CriticalSecret PatternCHANGELOG.md
CriticalSecret PatternCHANGELOG.md
CriticalSecret Patternscripts/e2e-core.js
CriticalSecret Patternscripts/e2e-core.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternlib/pure-utils.js
HighChild Processbin/leerness.js
HighShellbin/leerness.js
HighSame File Env Network Executionbin/leerness.js
HighCross File Remote Execution Contextbin/leerness.js
HighRuntime Package Installbin/leerness.js
MediumDynamic Requirebin/leerness.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalbin/leerness.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings