registry  /  nitronplus  /  2.5.8

nitronplus@2.5.8

Nitronplus — JS bridge for notifications, permissions, system sounds, call management, PiP, and more

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 10 file(s), 59.1 KB of source, external domains: adoptium.net, dl.google.com, schemas.android.com

Source & flagged code

4 flagged · loading source
dist/chunk-JJ4NDXSO.jsView file
3// src/signer.ts L4: import { execFile } from "child_process"; L5: import { access, mkdir } from "fs/promises"; ... L12: var __filename = fileURLToPath(import.meta.url); L13: var __dirname = dirname(__filename); L14: function getSignerJarPath() { ... L17: async function findJava() { L18: const javaHomeRaw = process.env.JAVA_HOME; L19: if (javaHomeRaw) { L20: const javaHome = javaHomeRaw.trim(); L21: const ext = process.platform === "win32" ? ".exe" : ""; L22: const javaBin = join(javaHome, "bin", `java${ext}`);
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-JJ4NDXSO.jsView on unpkg · L3
template/base.apkView file
•path = template/base.apk kind = compressed_blob sizeBytes = 15694 magicHex = [redacted]
Medium
Ships Compressed Blob

Package ships compressed or archive-like blobs.

template/base.apkView on unpkg
•path = template/base.apk kind = nested_archive_needs_inspection sizeBytes = 15694 magicHex = [redacted]
Low
Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

template/base.apkView on unpkg
vendor/uber-apk-signer.jarView file
•path = vendor/uber-apk-signer.jar kind = high_entropy_blob sizeBytes = 3208194 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vendor/uber-apk-signer.jarView on unpkg

Findings

2 High4 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/chunk-JJ4NDXSO.js
HighShips High Entropy Blobvendor/uber-apk-signer.jar
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobtemplate/base.apk
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectiontemplate/base.apk