registry / most-box / 0.4.1

most-box@0.4.1

MostBox - chat-first P2P toolbox for files, notes, and game rooms

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 251 file(s), 4.48 MB of source, external domains: 127.0.0.1, api.iconify.design, api.most.box, api.simplesvg.com, api.unisvg.com, debank.com, download.most.box, empty.invalid, github.com, most-people.com, most.box, prosemirror.net, react.dev, rolldown.rs, vuejs.org, www.w3.org

Source & flagged code

5 flagged

out/assets/index.lazy-DIVWkli0.jsView file

Lines 1-3javascript

1import{n as e,o as t,t as n}from"./jsx-runtime-Bt-cYkS5.js";import{A as r,B as i,E as a,F as o,G as s,L as c,M as l,R as u,U as d,j as f,t as p}from"./useAppStore-CWDKvs0t.js";import{a as m}from"./i18n-aawGNpFa.js";import{t as h}from"./fingerprint-pattern-CBNV2aHX.js";import{i as g}from"./AccountMenu-tbWfF5-D.js";import{t as _}from"./download-CMlCmGZh.js";import{t as v}from"./external-link-2Ie6c9M0.js";import{n as y,t as b}from"./CopyButton-dkNZkdzR.js";import{t as x}from"./lock-CUyoQ_BG.js";import{t as ee}from"./AppShell-sd2mnWAE.js";import{n as S,r as C}from"./esm-tnZK2K_f.js";import{t as w} ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/assets/index.lazy-DIVWkli0.jsView on unpkg · L1

Critical

Secret Pattern

RSA private key in out/assets/index.lazy-DIVWkli0.js

out/assets/index.lazy-DIVWkli0.jsView on unpkg · L1

2`)}\n-----END PRIVATE KEY-----`},_e=e=>{let t=new Uint8Array([48,5,6,3,43,101,112]),n=new Uint8Array([3,33,0,...e]),r=t.length+n.length,i=new Uint8Array(2+r);i[0]=48,i[1]=r;let a=2;return i.set(t,a),a+=t.length,i.set(n,a),`-----BEGIN PUBLIC KEY-----\n${L(i).match(/.{1,64}/g)?.join(`

3`)}\n-----END PUBLIC KEY-----`},R=[`wallet`,`pem`,`export`,`EA`];function ve(){let e=window.location.hash.replace(`#`,``);return R.includes(e)?e:`wallet`}function ye(){let{t:e}=m(),t=p(e=>e.addToast),n=a(e=>e.setUserIdentity),[s,u]=(0,k.useState)(`wallet`),[d,h]=(0,k.useState)(``),[_,v]=(0,k.useState)(``),[b,S]=(0,k.useState)(!1),[C,T]=(0,k.useState)(null),[E,D]=(0,k.useState)(null),[te,oe]=(0,k.useState)(``),[se,O]=(0,k.useState)(``),[ce,le]=(0,k.useState)(``),[j,ue]=(0,k.useState)(``),[M,N]=(0,k.useState)([]),[P,F]=(0,k.useState)(0),[I,L]=(0,k.useState)(!0),[R,ye]=(0,k.useState)(!0),[z,be]=( ...

Long lines were clipped for display.

out/assets/livescript-BXxG0Yva.jsView file

Lines 1-1javascript

1var e=function(e,t){var n=t.next||`start`;if(n){t.next=t.next;var r=a[n];if(r.splice){for(var i=0;i<r.length;++i){var o

out/logo.icoView file

•path = out/logo.ico kind = high_entropy_blob sizeBytes = 8039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

out/logo.icoView on unpkg

out/assets/index.lazy-BVmqAS0H.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = most-box@0.3.8 matchedIdentity = npm:bW9zdC1ib3g:0.3.8 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/assets/index.lazy-BVmqAS0H.jsView on unpkg

Source & flagged code

5 flagged · loading source

out/assets/index.lazy-DIVWkli0.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = import{n...in(`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/assets/index.lazy-DIVWkli0.jsView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = import{n...in(`

Critical

Secret Pattern

RSA private key in out/assets/index.lazy-DIVWkli0.js

out/assets/index.lazy-DIVWkli0.jsView on unpkg · L1

out/assets/livescript-BXxG0Yva.jsView file

1var e=function(e,t){var n=t.next||`start`;if(n){t.next=t.next;var r=a[n];if(r.splice){for(var i=0;i<r.length;++i){var o=r[i];if(o.regex&&e.match(o.regex))return t.next=o.next||t.ne...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/assets/livescript-BXxG0Yva.jsView on unpkg · L1

out/logo.icoView file

•path = out/logo.ico kind = high_entropy_blob sizeBytes = 8039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

out/logo.icoView on unpkg

out/assets/index.lazy-BVmqAS0H.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/assets/index.lazy-BVmqAS0H.jsView on unpkg

Findings

2 Critical2 High5 Medium5 Low

CriticalCritical Secretout/assets/index.lazy-DIVWkli0.js

CriticalSecret Patternout/assets/index.lazy-DIVWkli0.js

HighShips High Entropy Blobout/logo.ico

HighPrevious Version Dangerous Deltaout/assets/index.lazy-BVmqAS0H.js

MediumDynamic Requireout/assets/livescript-BXxG0Yva.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

out/assets/index.lazy-DIVWkli0.jsView file

Lines 1-3javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/assets/index.lazy-DIVWkli0.jsView on unpkg · L1

Critical

Secret Pattern

RSA private key in out/assets/index.lazy-DIVWkli0.js

out/assets/index.lazy-DIVWkli0.jsView on unpkg · L1

Long lines were clipped for display.

out/assets/livescript-BXxG0Yva.jsView file

Lines 1-1javascript

1var e=function(e,t){var n=t.next||`start`;if(n){t.next=t.next;var r=a[n];if(r.splice){for(var i=0;i<r.length;++i){var o

out/logo.icoView file

•path = out/logo.ico kind = high_entropy_blob sizeBytes = 8039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

out/logo.icoView on unpkg

out/assets/index.lazy-BVmqAS0H.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/assets/index.lazy-BVmqAS0H.jsView on unpkg