registry  /  nano-pow  /  5.2.0

nano-pow@5.2.0

Proof-of-work generation and validation with WebGPU/WebGL/WASM for Nano cryptocurrency.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
CopyleftLicense
scanned 4 file(s), 157 KB of source, external domains: nanopow.invalid, www.npmjs.com

Source & flagged code

3 flagged · loading source
dist/bin/cli.jsView file
4import { Logger, isHex32, isHex8, stats } from "nano-pow/utils"; L5: import { spawn } from "node:child_process"; L6: import { getRandomValues } from "node:crypto";
High
Child Process

Package source references child process execution.

dist/bin/cli.jsView on unpkg · L4
4Cross-file remote execution chain: dist/bin/cli.js spawns dist/bin/server.js; helper contains network access plus dynamic code execution. L4: import { Logger, isHex32, isHex8, stats } from "nano-pow/utils"; L5: import { spawn } from "node:child_process"; L6: import { getRandomValues } from "node:crypto"; ... L9: const logger = new Logger(); L10: delete process.env.NANO_POW_DEBUG; L11: delete process.env.NANO_POW_EFFORT; ... L52: Report bugs: <bug-nano-pow@codecow.com> L53: Full documentation: <https://www.npmjs.com/package/nano-pow> L54: `); ... L180: server.on("close", (code) => { L181: logger.log(`Server closed with exit code ${code}`); L182: process.exit(code);
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/cli.jsView on unpkg · L4
dist/bin/nano-pow.shView file
•path = dist/bin/nano-pow.sh kind = build_helper sizeBytes = 602 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/nano-pow.shView on unpkg

Findings

3 High4 Medium6 Low
HighChild Processdist/bin/cli.js
HighShell
HighCross File Remote Execution Contextdist/bin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/bin/nano-pow.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License