registry / mobbdev / 1.4.35

mobbdev@1.4.35

Automated secure code remediation tool

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 1.23 MB of source, external domains: admin.mycompany.com, api.mobb.ai, app.mobb.ai, app.vssps.visualstudio.com, ast.checkmarx.net, bitbucket.org, caniuse.com, content.mobb.ai, dev.azure.com, developer.mozilla.org, docs.djangoproject.com, docs.mobb.ai, docs.oracle.com, docs.snyk.io, github.com, gitlab.com, http-intake.logs.datadoghq.com, iam.checkmarx.net, jinja.palletsprojects.com, json.schemastore.org, learn.microsoft.com, mvnrepository.com, nodejs.org, portswigger.net, pypi.org, requests.readthedocs.io, www.example.com, www.npmjs.com, www.oracle.com, www.w3.org, www.w3schools.com

Source & flagged code

9 flagged

package.jsonView file

Lines 1-31json

2 "name": "mobbdev",

3 "version": "1.4.35",

4 "description": "Automated secure code remediation tool",

5 "repository": "git+https://github.com/mobb-dev/bugsy.git",

6 "main": "dist/index.mjs",

7 "module": "dist/index.mjs",

8 "scripts": {

9 "clean": "rm -rf build",

10 "env": "dotenv -e ./.env",

11 "postinstall": "node ./src/post_install/cx_install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 "build": "tsc && tsup-node --env.NODE_ENV production",

13 "build:dev": "tsup-node --env.NODE_ENV development",

14 "increment-version": "./src/scripts/increment-version.sh",

15 "test:unit:mcp": "vitest run __tests__/mcp/",

16 "test:unit:mcp:ci": "vitest run --bail=1 __tests__/mcp/",

17 "test:mcp:watch": "vitest watch __tests__/mcp/",

18 "test:mcp:verbose": "pnpm run build && NODE_ENV=test VERBOSE=true vitest run __tests__/mcp/",

19 "test:mcp:all": "pnpm run test:unit:mcp && pnpm run test:integration:mcp && pnpm run test:e2e:mcp",

20 "test:unit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/integration.baseline-commit.test.ts' --exclude='**/__tests__/mcp/**'",

21 "test:unit:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/integration.baseline-commit.test.ts' --exclude='**/__tests__/mcp/**'",

22 "test:integration": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.test.ts",

23 "test:integration:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.test.ts",

24 "test:integration:baseline-commit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.baseline-commit.test.ts",

25 "test:integration:baseline-commit:proxy": "GIT_PROXY_HOST=http://tinyproxy:8888 HTTP_PROXY=http://localhost:8888 API_URL=http://app-api:8080/v1/graphql TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.baseline-commit.test.ts",

26 "test:integration:mcp": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.mcp.test.ts",

27 "test:integration:mcp:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.mcp.test.ts",

28 "test:integration:watch": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest watch run __tests__/integration.test.ts",

29 "test": "pnpm run test:unit && pnpm run test:integration",

30 "test:ci": "pnpm run test:unit:ci -- --coverage && pnpm run test:integration:ci -- --coverage",

31 "test:ado": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run ado.test",

.envView file

Lines 1-10text

1# production@v21

2API_URL="https://api.mobb.ai/v1/graphql"

3WEB_APP_URL="https://app.mobb.ai"

4GITLAB_API_TOKEN=""

5GITHUB_API_TOKEN=""

6ADO_TEST_ACCESS_TOKEN=""

7HASURA_ACCESS_KEY=""

8LOCAL_GRAPHQL_ENDPOINT=""

9GIT_PROXY_HOST="http://tinyproxy:8888"

10DD_RUM_TOKEN="pubf59c0182545bfb4c299175119f1abf9b"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

54961. An executable name: L5497: - \`exec(input);\` L5498: - \`exec("/bin/bash " + input);\`

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L5496

4675content: () => "Is the input data interpolated into a shell command (not the program name or shell structure)?", L4676: description: () => `\`system()\` / \`popen()\` hand the whole string to \`/bin/sh -c\`. Answer **yes** when the input is *data* placed into a fixed command, for example: L4677:

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L4675

335patch L336: patchOriginalEncodingBase64 L337: questions { ... L1079: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1080: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1081: __typename ... L1668: const { url } = sourceCodeFile.signedFile; L1669: const sourceCodeRes = await fetch(url); L1670: if (Number(sourceCodeRes.headers.get("Content-Length")) > MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES) { ... L2658: GITHUB_API_CONCURRENCY L2659: } = EnvVariablesZod.parse(process.env)); L2660: }

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.mjsView on unpkg · L335

5502

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code