registry / mobkit / 0.9.4

mobkit@0.9.4

⚠ Under review

MobKit —— APICloud / AVM 移动工程的 WiFi 真机同步、用友云工作台集成与 MCP 服务。命令行（mobkit / mk）与程序化库（import { wifiSync } from 'mobkit'）同包。

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 4 file(s), 2.39 MB of source, external domains: 127.0.0.1, community.apicloud.com, github.com, jimmy.warting.se, json-schema.org, open.diwork.com, raw.githubusercontent.com, www.w3.org

Source & flagged code

7 flagged

dist/vite.mjsView file

Lines 1-39javascript

1import{createRequire as P0}from"node:module";var R0=Object.create;var{getPrototypeOf:S0,defineProperty:Qf,getOwnPropertyNames:C0}=Object;var B0=Object.prototype.hasOwnProperty;function x0(n){return this[n]}var z0,j0,sn=(n,t,i)=>{var f=n!=null&&typeof n==="object";if(f){var $=t?z0??=new WeakMap:j0??=new WeakMap,c=$.get(n);if(c)return c}i=n!=null?R0(S0(n)):{};let u=t||!n||!n.__esModule?Qf(i,"default",{value:n,enumerable:!0}):i;for(let y of C0(n))if(!B0.call(u,y))Qf(u,y,{get:x0.bind(n,y),enumerable:!0});if(f)$.set(n,u);return u};var l=(n,t)=>()=>(t||n((t={exports:{}}).exports,t),t.exports);var q0 ...

2`).join(`\r

3`)),$.removeListener("error",Fu),Q.setSocket($,c,{allowSynchronousEvents:this.options.allowSynchronousEvents,maxBufferedChunks:this.options.maxBufferedChunks,maxFragments:this.options.maxFragments,maxPayload:this.options.maxPayload,skipUTF8Validation:this.options.skipUTF8Validation}),this.clients)this.clients.add(Q),Q.on("close",()=>{if(this.clients.delete(Q),this._shouldEmitClose&&!this.clients.size)process.nextTick(kt,this)});u(Q,f)}}Zu.exports=gu;function $4(n,t){for(let i of Object.keys(t))n.on(i,t[i]);return function(){for(let f of Object.keys(t))n.removeListener(f,t[f])}}function kt(n){n ...

4`+Object.keys(f).map(($)=>`${$}: ${f[$]}`).join(`\r

5`)+`\r

6\r

7`+i)}function Vt(n,t,i,f,$,c){if(n.listenerCount("wsClientError")){let u=Error($);Error.captureStackTrace(u,Vt),n.emit("wsClientError",u,i,t)}

8]))+`;a5.KANJI=new RegExp(gi,"g");a5.BYTE_KANJI=new RegExp("[^A-Z0-9 $%*+\\-./:]+","g");a5.BYTE=new RegExp(p5,"g");a5.NUMERIC=new RegExp("[0-9]+","g");a5.ALPHANUMERIC=new RegExp("[A-Z $%*+\\-./:]+","g");var d5=new RegExp("^"+gi+"$"),k5=new RegExp("^[0-9]+$"),o5=new RegExp("^[A-Z0-9 $%*+\\-./:]+$");a5.testKanji=function(t){return d5.test(t)};a5.testNumeric=function(t){return k5.test(t)};a5.testAlphanumeric=function(t){return o5.test(t)}});var yt=l((F6)=>{var J6=bf(),df=pf();F6.NUMERIC={id:"Numeric",bit:1,ccBits:[10,12,14]};F6.ALPHANUMERIC={id:"Alphanumeric",bit:2,ccBits:[9,11,13]};F6.BYTE={id:" ...

9Make sure your charset is UTF-8`);i=(i>>>8&255)*192+(i&255),n.put(i,13)}};O1.exports=jt});var P1=l((yg,$$)=>{var Zi

10 Suggested mode is: `+Xn.toString(f));if(i===Xn.KANJI&&!nf.isKanjiModeEnabled())i=Xn.BYTE;switch(i){case Xn.NUMERIC:return new l1(n);case Xn.ALPHANUMERIC:return new E1(n);case Xn.KANJI:return new D1(n);case Xn.BYTE:return new w1(n)}}q6.fromArray=function(t){return t.reduce(function(i,f){if(typeof f==="string")i.push(_1(f,null));else if(f.data)i.push(_1(f.data,f.mode));return i},[])};q6.fromString=function(t,i){let f=v1(t,nf.isKanjiModeEnabled()),$=z6(f),c=j6($,i),u=B6.find_path(c.map,"start","end"),y=[];for(let J=1;J<u.length-1;J++)y.push(c.table[u[J]].node);return q6.fromArray(x6(y))};q6.rawS ...

11The chosen QR Code version cannot contain this amount of data.

12Minimum version required to store current data is: `+c+`.

13`);let u=d6(t,i,$),y=ff.getSymbolSize(t),J=new s6(y);if(v6(J,t),h6(J),e6(J,t),Q$(J,i,0),t

14`);let Q=Array(f.margin+1).join($.WW);y+=J;for(let F=0;F<c;F+=2){y+=Q;for(let Z=0;Z<c;Z++){let m=u[F*c+Z],T=u[(F+1)*c+Z];y+=CJ(m,T,$)}y+=Q+`

15`}if(y+=J.slice(0,-1),typeof i==="function")i(null,y);return y};BJ.renderToFile=function(t,i,f,$){if(typeof $>"u")$=f,f=void 0;let c=gn("fs"),u=BJ.render(i,f);c.writeFile(t,u,$)}});var wy=l((zJ)=>{zJ.render=function(n,t,i){let f=n.modules.size,$=n.modules.data,c="\x1B[40m \x1B[0m",u="\x1B[47m \x1B[0m",y="",J=Array(f+3).join("\x1B[47m \x1B[0m"),Q=Array(2).join("\x1B[47m \x1B[0m");y+=J+`

16`;for(let F=0;F<f;++F){y+="\x1B[47m \x1B[0m";for(let Z=0;Z<f;Z++)y+=$[F*f+Z]?"\x1B[40m \x1B[0m":"\x1B[47m \x1B[0m";y+=Q+`

17`}if(y+=J+`

18`,typeof i==="function")i(null,y);return y}});var hy=l((PJ)=>{var qJ="\x1B[47m\x1B[30m",OJ="\x1B[40m\x1B[37m",LJ=function(n,t,i){return{"00":"\x1B[0m "+n,"01":"\x1B[0m"+t+"▄"+n,"02":"\x1B[0m"+i+"▄"+n,10:"\x1B[0m"+t+"▀"+n,11:" ",12:"▄",20:"\x1B[0m"+i+"▀"+n,21:"▀",22:"█"}},Dy=function(n,t,i,f){let $=t+1;if(i>=$||f>=$||f<-1||i<-1)return"0";if(i>=t||f>=t||f<0||i<0)return"1";let c=f*t+i;return n[c]?"2":"1"},vy=function(n,t,i,f){return Dy(n,t,i,f)+Dy(n,t,i,f+1)};PJ.render=function(n,t,i){let f=n.modules.size,$=n.modules.data,c=!!(t&&t.inverse),u=t&&t.inverse?OJ:qJ,Q=LJ(u,c?"\x1B[30m":"\x1B[37m",c?"\ ...

19`+u,Z=u;for(let m=-1;m<f+1;m+=2){for(let T=-1;T<f;T++

20`;if(typeof f==="function")f(null,m);return m}});var dy=l((pJ)=>{var bJ=C$();pJ

21(function(){

High

Child Process

Package source references child process execution.

dist/vite.mjsView on unpkg · L19

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/vite.mjsView on unpkg · L6

22 function syncOrigin(){

23 if(typeof window.__MOBKIT_SYNC_ORIGIN__==='string'&&window.__MOBKIT_SYNC_ORIGIN__)

24 return window.__MOBKIT_SYNC_ORIGIN__;

25 if(location.protocol==='http:'||location.protocol==='https:')

26 return location.origin;

27 return null;

28 }

29 var base=syncOrigin();

30 if(!base)return;

31 var p=null;

32 try{

33 var x=new XMLHttpRequest();

34 x.open('GET',base+'/_mobkit/dev-lane',false);

35 x.send(null);

36 if(x.status===200&&x.responseText)p=JSON.parse(x.responseText);

37 }catch(e){}

38 if(!p||!p.url)return;

39 // 已在热更页：勿 location.replace 自己（Vite 再注 boot 或同页重载会死循环白屏）

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = mobkit@0.9.0 matchedIdentity = npm:bW9ia2l0:0.9.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/vite.mjsView on unpkg

dist/index.mjsView file

1import{createRequire as QIA}from"node:module";var dBA=Object.create;var{getPrototypeOf:pBA,defineProperty:l9,getOwnPropertyNames:rBA}=Object;var oBA=Object.prototype.hasOwnProperty... L2: `);$=U.pop()??"";for(let N of U)if(N.trim())B(N)}),D.on("error",C),D.on("close",()=>{if($.trim())B($);g()})})}async function gIA(A,Q,B){return new Promise((I,E)=>{let g=p9(A,Q,{sig... L3: `).slice(1)){let I=B.trim();if(!I)continue;let[E,g,...C]=I.split(/\s+/);if(!E||!g)continue;let D=Object.fromEntries(C.map((F)=>F.split(":")).filter((F)=>F.length===2)),$=g==="devic... L4: `).map((B)=>B.trim()).filter((B)=>B&&B!=="[Empty]");return Promise.all(Q.map(async(B)=>({id:B,platform:"harmony",name:await B6(B,"const.product.model")??B,model:await B6(B,"const.p... L5: `).join(`\r

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.mjsView on unpkg · L1

Source & flagged code

7 flagged · loading source

dist/vite.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code