Static Scan Results
scanned 6d ago · by rust-scannerStatic analysis flagged 39 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
32 flagged · loading sourcebin/leerness.jsView file
3012patternName = aws_access_key
severity = critical
line = 3012
matchedText = const fn...b');
Critical
Critical Secret
Package contains a critical-looking secret pattern.
bin/leerness.jsView on unpkg · L3012•matchType = previous_version_dangerous_delta
matchedPackage = leerness@1.35.10
matchedIdentity = npm:bGVlcm5lc3M:1.35.10
similarity = 0.762
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/leerness.jsView on unpkg3012patternName = aws_access_key
severity = critical
line = 3012
matchedText = const fn...b');
Critical
3418patternName = aws_access_key
severity = critical
line = 3418
matchedText = const be...lse;
Critical
3528patternName = aws_access_key
severity = critical
line = 3528
matchedText = return f...true
Critical
3531patternName = aws_access_key
severity = critical
line = 3531
matchedText = && f('AK...alse
Critical
5const path = require('path');
L6: const cp = require('child_process');
L7: const { log, ok, warn, fail, failJson, setQuiet, today, now, absRoot, exists, read, readBuf, mkdirp, writeUtf8, append, rel } = require('../lib/io'); // 1.9.382/383 (UR-0025): 출력/...
High
50try {
L51: const r = cp.spawnSync('chcp.com', [], { encoding: 'utf8', timeout: 2000, shell: true });
L52: const out = (r.stdout || '') + (r.stderr || '');
High
3018{ name: 'MCP notification 준수: id없는 요청 무응답 가드 + ping {} (UR-0049 설치리뷰 1.9.313)', run: () => { const src = read(__filename); const guard = src.includes("const isNotification = !('id'...
L3019: { name: 'PowerShell 감지: pwsh7(channel/Documents\\PowerShell/install) + ps5.1 영구경로 과경고 안함 (UR-0052 설치리뷰 1.9.314)', run: () => { const f = _detectPwshFromEnv; const pwsh7a = f({ POWE...
L3020: { name: 'doc/surface 정합: doctor 명령 + stale MCP 카운트 동적화(commands/banner) (UR-0054 설치리뷰 1.9.315)', run: () => { const src = read(__filename); const doctorOk = typeof doctorCmd === 'f...
L3021: { name: 'drift 마커 버그: session-handoff 프론트매터는 ^--- 일 때만 + drift 최신 Last generated (1.9.316)', run: () => { const src = read(__filename); const scSrc = read(path.join(path.dirname(__...
L3022: { name: '텔레메트리 분리: 내부 auto-call(LEERNESS_INTERNAL) usage 집계 제외 + 주요 spawn 마킹 (UR-0051 설치리뷰 1.9.317)', run: () => { const src = read(__filename); const guard = src.includes("process...
L3023: { name: 'lib/pure-utils: HTML 파싱 유틸 3종 모듈 분리 + 동작 + 인라인 제거 (UR-0025 1.9.318)', run: () => { const m = require('../lib/pure-utils'); const fnOk = typeof m._htmlToText === 'function'...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/leerness.jsView on unpkg · L30185Cross-file remote execution chain: bin/leerness.js spawns scripts/e2e.js; helper contains network access plus dynamic code execution.
L5: const path = require('path');
L6: const cp = require('child_process');
L7: const { log, ok, warn, fail, failJson, setQuiet, today, now, absRoot, exists, read, readBuf, mkdirp, writeUtf8, append, rel } = require('../lib/io'); // 1.9.382/383 (UR-0025): 출력/...
...
L40: // 해결: 부작용을 _cliBootstrap() 으로 묶고 파일 끝 require.main 가드에서만 호출. import/단위테스트는 부작용 0.
L41: // 1.9.249 (UR-0018): 터미널 출력 한국어 깨짐 사전 방지 (stdout UTF-8 + Windows 비-65001 시 chcp 65001 자동, opt-out LEERNESS_NO_AUTOCHCP=1).
L42: function _ensureStdoutEncoding() {
...
L46: } catch {}
L47: if (process.platform !== 'win32') return;
L48: if (process.env.LEERNESS_NO_AUTOCHCP === '1') return;
L49: if (process.env._LEERNESS_CHCP_DONE === '1') return; // 자식 spawn 무한 재호출 방지
...
L70: if (w && (w.code === 'DEP0190' || /DEP0190/.test(String(w.message || '')))) return;
L71: process.stderr.write(`(node:${process.pid}) ${w.name || 'Warning'}: ${w.message || w}\n`);
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/leerness.jsView on unpkg · L52652log(` 🖥 Hardware: ${env.hardware.cpus} CPUs · ${env.hardware.memGB} GB RAM`);
L2653: log(` 🖱 Terminal: TTY=${env.terminal.isTTY}${env.terminal.powershell ? ` · PowerShell v${env.terminal.powershell}` : ''}`);
L2654: log(` 🔧 Tools:`);
...
L2664: // 1.9.254: leerness CLI PATH 자동 등록 (사용자 명시 UR-0019)
L2665: // 배경: `npm i -g leerness` 했는데 npm global bin 이 PATH 에 없으면 `leerness` 명령이 안 먹힘.
L2666: // 해결: global bin 경로 감지 + PATH 포함 여부 확인 → 미등록 시 플랫폼별 안전 등록 (opt-in --apply).
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/leerness.jsView on unpkg · L26523L4: const fs = require('fs');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/leerness.jsView on unpkg · L33104{ name: 'graph --html: 빈/미초기화 하네스 무크래시 + 유효 빈 HTML (1.35.0 방어가드)', run: () => { const m = require('../lib/graph'); let ok = false; const tmp = fs.mkdtempSync(path.join(os.tmpdir(),...
L3105: { name: 'graph --html: 임베드 script JS 신택스 유효성(U+2028/정규식 리터럴 회귀 영구 차단, 1.35.2)', run: () => { const m = require('../lib/graph'); let ok = false; const tmp = fs.mkdtempSync(path.join...
L3106: { name: '7번째 버그헌트 P1-A (UR-0104): 테이블셀 안전화 _cellSafe/_cellUnescape (파이프/개행 injection 차단) (1.9.399)', run: () => { const m = require('../lib/pure-utils'); if (m._cellSafe !== _cellS...
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin/leerness.jsView on unpkg · L3104CHANGELOG.mdView file
391patternName = aws_access_key
severity = critical
line = 391
matchedText = - **FN-g...귀 0.
Critical
1923patternName = aws_access_key
severity = critical
line = 1923
matchedText = - `_isPl... 차단.
Critical
2123patternName = aws_access_key
severity = critical
line = 2123
matchedText = **🔑 `AKI...드.**
Critical
scripts/e2e-core.jsView file
51patternName = aws_access_key
severity = critical
line = 51
matchedText = fs.write...n');
Critical
75patternName = aws_access_key
severity = critical
line = 75
matchedText = fs.write...n');
Critical
scripts/e2e.jsView file
4452patternName = aws_access_key
severity = critical
line = 4452
matchedText = fs.write...8');
Critical
5002patternName = npm_token
severity = critical
line = 5002
matchedText = fs.write...n');
Critical
5421patternName = npm_token
severity = critical
line = 5421
matchedText = fs.write...n');
Critical
5979patternName = github_pat
severity = critical
line = 5979
matchedText = fs.write...;');
Critical
6130patternName = github_pat
severity = critical
line = 6130
matchedText = fs.write...n');
Critical
6130patternName = aws_access_key
severity = critical
line = 6130
matchedText = fs.write...n');
Critical
6137patternName = aws_access_key
severity = critical
line = 6137
matchedText = fs.write...n');
Critical
6144patternName = github_pat
severity = critical
line = 6144
matchedText = fs.write...n');
Critical
6144patternName = aws_access_key
severity = critical
line = 6144
matchedText = fs.write...n');
Critical
6150patternName = aws_access_key
severity = critical
line = 6150
matchedText = fs.write...n');
Critical
6559patternName = aws_access_key
severity = critical
line = 6559
matchedText = fs.write...n');
Critical
6639patternName = aws_access_key
severity = critical
line = 6639
matchedText = fs.write...;');
Critical
6860patternName = private_key_rsa
severity = critical
line = 6860
matchedText = fs.write...n');
Critical
lib/pure-utils.jsView file
660patternName = aws_access_key
severity = critical
line = 660
matchedText = // 1.10....E 등.
Critical
Findings
25 Critical5 High4 Medium5 Low
CriticalCritical Secretbin/leerness.js
CriticalPrevious Version Dangerous Deltabin/leerness.js
CriticalSecret Patternbin/leerness.js
CriticalSecret Patternbin/leerness.js
CriticalSecret Patternbin/leerness.js
CriticalSecret Patternbin/leerness.js
CriticalSecret PatternCHANGELOG.md
CriticalSecret PatternCHANGELOG.md
CriticalSecret PatternCHANGELOG.md
CriticalSecret Patternscripts/e2e-core.js
CriticalSecret Patternscripts/e2e-core.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternscripts/e2e.js
CriticalSecret Patternlib/pure-utils.js
HighChild Processbin/leerness.js
HighShellbin/leerness.js
HighSame File Env Network Executionbin/leerness.js
HighCross File Remote Execution Contextbin/leerness.js
HighRuntime Package Installbin/leerness.js
MediumDynamic Requirebin/leerness.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalbin/leerness.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings