Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 19 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsProtestwareUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
11L12: const { execSync } = require('child_process');
L13: const fs = require('fs');
High
Child Process
Package source references child process execution.
scripts/postinstall.jsView on unpkg · L11src/commands/policy.jsView file
90const { execSync } = require('child_process');
L91: const output = execSync(`powershell -Command "Get-PSDrive -Name ${drive} | Select-Object -ExpandProperty Free"`, { encoding: 'utf-8' }).trim();
L92: const free = parseInt(output);
High
bin/natureco.jsView file
2L3: const { Command } = require('commander');
L4: const chalk = require('chalk');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/natureco.jsView on unpkg · L2src/commands/gateway-server.jsView file
4const os = require('os');
L5: const { spawn, execSync } = require('child_process');
L6: const pino = require('pino');
...
L9:
L10: const PID_FILE = path.join(os.homedir(), '.natureco', 'gateway.pid');
L11: const LOG_FILE = path.join(os.homedir(), '.natureco', 'gateway.log');
...
L16: // restart this would crash. Explicit.
L17: const https = require('https');
L18: // saveConfig (and the loaded `config` value, when not shadowed in scope)
...
L70:
L71: // Note: File writing removed - parent process redirects stdout/stderr to log file
L72: // This prevents duplicate log entries
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/commands/gateway-server.jsView on unpkg · L4src/tools/cron_create.jsView file
10const os = require("os");
L11: const { execSync } = require("child_process");
L12:
L13: const CRON_FILE = path.join(os.homedir(), ".natureco", "crons.json");
L14:
...
L17: if (!fs.existsSync(CRON_FILE)) return [];
L18: return JSON.parse(fs.readFileSync(CRON_FILE, "utf8"));
L19: } catch { return []; }
...
L68:
L69: // İstege bagli: gercek crontab'a da ekle (sistem cron)
L70: // Bu tehlikeli olabilir, sadece bilgi veriyoruz
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
src/tools/cron_create.jsView on unpkg · L10src/tools/voice_chat.jsView file
15const path = require("path");
L16: const { spawn } = require("child_process");
L17: const https = require("https");
L18:
...
L25: return new Promise((resolve, reject) => {
L26: const apiKey = process.env.OPENAI_API_KEY || process.env.WHISPER_API_KEY;
L27: if (!apiKey) {
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/tools/voice_chat.jsView on unpkg · L15src/tools/phone_control_enhanced.jsView file
1const { getConfig, saveConfig } = require('../utils/config');
L2: const { execSync } = require('child_process');
L3:
...
L46: if (service === 'pushover') {
L47: const token = config.pushoverToken || process.env.PUSHOVER_TOKEN;
L48: const user = config.pushoverUser || process.env.PUSHOVER_USER;
L49: if (!token || !user) return { success: false, error: 'Pushover token/user gerekli' };
L50: const r = await fetch('https://api.pushover.net/1/messages.json', {
L51: method: 'POST',
L52: headers: { 'Content-Type': 'application/json' },
L53: body: JSON.stringify({ token, user, title: params.title || 'NatureCo', message: params.message, priority: params.priority || 0 })
L54: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/tools/phone_control_enhanced.jsView on unpkg · L1src/utils/plugin-registry.jsView file
124try {
L125: execSync(`npm install ${pkg} --prefix "${tmpDir}" --no-save --ignore-scripts --no-audit --no-fund`, { stdio: 'pipe', timeout: 120000 });
L126: const pkgDir = path.join(tmpDir, 'node_modules', pkg.split('/').pop());
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
src/utils/plugin-registry.jsView on unpkg · L124Findings
1 Critical5 High7 Medium6 Low
CriticalCredential Exfiltrationsrc/tools/phone_control_enhanced.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/postinstall.js
HighShellsrc/commands/policy.js
HighSame File Env Network Executionsrc/tools/voice_chat.js
HighRuntime Package Installsrc/utils/plugin-registry.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/natureco.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/tools/cron_create.js
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/commands/gateway-server.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings