registry / most-box / 0.3.5

most-box@0.3.5

MostBox - chat-first P2P toolbox for files, notes, and game rooms

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 243 file(s), 4.33 MB of source, external domains: 127.0.0.1, api.iconify.design, api.most.box, api.simplesvg.com, api.unisvg.com, debank.com, download.most.box, empty.invalid, github.com, most-people.com, most.box, prosemirror.net, react.dev, rolldown.rs, vuejs.org, www.w3.org

Source & flagged code

5 flagged

out/assets/index.lazy-B1iJsXQ8.jsView file

Lines 1-3javascript

1import{n as e,o as t,t as n}from"./jsx-runtime-Bt-cYkS5.js";import{A as r,B as i,E as a,F as o,H as s,I as c,N as l,O as u,R as d,k as f,t as p}from"./useAppStore-DNhyhD20.js";import{a as m}from"./i18n-C6yaqRst.js";import{t as h}from"./fingerprint-pattern-BT73ASEB.js";import{i as g}from"./AccountMenu-D-wa5tux.js";import{t as _}from"./download-Cy2BlfKM.js";import{t as v}from"./external-link-D_AQSgxW.js";import{n as y,t as b}from"./CopyButton-DnFqfCN9.js";import{t as x}from"./lock-yG7M7GkB.js";import{t as S}from"./AppShell-BdRKZIZ9.js";import{t as C}from"./wallet-D6HZocla.js";import{M as w,N as ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/assets/index.lazy-B1iJsXQ8.jsView on unpkg · L1

Critical

Secret Pattern

RSA private key in out/assets/index.lazy-B1iJsXQ8.js

out/assets/index.lazy-B1iJsXQ8.jsView on unpkg · L1

2`)}\n-----END PRIVATE KEY-----`},ke=e=>{let t=new Uint8Array([48,5,6,3,43,101,112]),n=new Uint8Array([3,33,0,...e]),r=t.length+n.length,i=new Uint8Array(2+r);i[0]=48,i[1]=r;let a=2;return i.set(t,a),a+=t.length,i.set(n,a),`-----BEGIN PUBLIC KEY-----\n${X(i).match(/.{1,64}/g)?.join(`

3`)}\n-----END PUBLIC KEY-----`},Ae=[`wallet`,`pem`,`export`,`EA`];function je(){let e=window.location.hash.replace(`#`,``);return Ae.includes(e)?e:`wallet`}function Me(){let{t:e}=m(),t=p(e=>e.addToast),n=a(e=>e.setUserIdentity),[i,s]=(0,D.useState)(`wallet`),[c,h]=(0,D.useState)(``),[_,v]=(0,D.useState)(``),[b,w]=(0,D.useState)(!1),[T,E]=(0,D.useState)(null),[ie,ae]=(0,D.useState)(null),[oe,se]=(0,D.useState)(``),[ce,le]=(0,D.useState)(``),[k,ue]=(0,D.useState)(``),[A,j]=(0,D.useState)(``),[fe,me]=(0,D.useState)([]),[M,N]=(0,D.useState)(0),[P,he]=(0,D.useState)(!0),[F,I]=(0,D.useState)(!0),[L, ...

Long lines were clipped for display.

out/assets/livescript-BXxG0Yva.jsView file

Lines 1-1javascript

1var e=function(e,t){var n=t.next||`start`;if(n){t.next=t.next;var r=a[n];if(r.splice){for(var i=0;i<r.length;++i){var o

out/logo.icoView file

•path = out/logo.ico kind = high_entropy_blob sizeBytes = 8039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

out/logo.icoView on unpkg

out/assets/MilkdownEditor-C388llV6.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = most-box@0.3.4 matchedIdentity = npm:bW9zdC1ib3g:0.3.4 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/assets/MilkdownEditor-C388llV6.jsView on unpkg

Source & flagged code

5 flagged · loading source

out/assets/index.lazy-B1iJsXQ8.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = import{n...in(`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/assets/index.lazy-B1iJsXQ8.jsView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = import{n...in(`

Critical

Secret Pattern

RSA private key in out/assets/index.lazy-B1iJsXQ8.js

out/assets/index.lazy-B1iJsXQ8.jsView on unpkg · L1

out/assets/livescript-BXxG0Yva.jsView file

1var e=function(e,t){var n=t.next||`start`;if(n){t.next=t.next;var r=a[n];if(r.splice){for(var i=0;i<r.length;++i){var o=r[i];if(o.regex&&e.match(o.regex))return t.next=o.next||t.ne...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

out/assets/livescript-BXxG0Yva.jsView on unpkg · L1

out/logo.icoView file

•path = out/logo.ico kind = high_entropy_blob sizeBytes = 8039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

out/logo.icoView on unpkg

out/assets/MilkdownEditor-C388llV6.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/assets/MilkdownEditor-C388llV6.jsView on unpkg

Findings

2 Critical2 High5 Medium5 Low

CriticalCritical Secretout/assets/index.lazy-B1iJsXQ8.js

CriticalSecret Patternout/assets/index.lazy-B1iJsXQ8.js

HighShips High Entropy Blobout/logo.ico

HighPrevious Version Dangerous Deltaout/assets/MilkdownEditor-C388llV6.js

MediumDynamic Requireout/assets/livescript-BXxG0Yva.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

out/assets/index.lazy-B1iJsXQ8.jsView file

Lines 1-3javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/assets/index.lazy-B1iJsXQ8.jsView on unpkg · L1

Critical

Secret Pattern

RSA private key in out/assets/index.lazy-B1iJsXQ8.js

out/assets/index.lazy-B1iJsXQ8.jsView on unpkg · L1

Long lines were clipped for display.

out/assets/livescript-BXxG0Yva.jsView file

Lines 1-1javascript

1var e=function(e,t){var n=t.next||`start`;if(n){t.next=t.next;var r=a[n];if(r.splice){for(var i=0;i<r.length;++i){var o

out/logo.icoView file

•path = out/logo.ico kind = high_entropy_blob sizeBytes = 8039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

out/logo.icoView on unpkg

out/assets/MilkdownEditor-C388llV6.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/assets/MilkdownEditor-C388llV6.jsView on unpkg