nucleus-core-ts@0.9.719: Suspicious npm security report (Warn)

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 326 file(s), 3.72 MB of source, external domains: admin.yourapp.com, api.openweathermap.org, api.yourapp.com, cdn.jsdelivr.net, discord.com, github.com, json-schema.org, opensource.org, ossrdbms-aad.database.windows.net, provider.com, redis.azure.com, twitter.com, unpkg.com, www.googleapis.com, www.w3.org, yourapp.com

Source & flagged code

5 flagged

infra/scripts/generate-project.tsView file

Lines 1-33typescript

1#!/usr/bin/env bun

2/**

3 * Nucleus Project Scaffolding Script

4 *

5 * Reads a config.json, validates it, and generates a full-mode API + frontend project

6 * with k8s manifests, azure-pipelines, .env files, and config.ts injection.

7 *

8 * Usage: bun run infra/scripts/generate-project.ts

9 */

10

11import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs'

12import { join, resolve } from 'path'

13import { createInterface } from 'readline/promises'

14import { spawnSync } from 'child_process'

15

High

Child Process

Package source references child process execution.

infra/scripts/generate-project.tsView on unpkg · L13

16// ─── Helpers ───────────────────────────────────────────────────────────────────

17

18const BOLD = '\x1b[1m'

19const DIM = '\x1b[2m'

20const GREEN = '\x1b[32m'

21const CYAN = '\x1b[36m'

22const YELLOW = '\x1b[33m'

23const RED = '\x1b[31m'

24const RESET = '\x1b[0m'

25

26function log(msg: string) {

27 console.log(msg)

28}

29

30function logStep(step: string) {

31 log(`\n${CYAN}${BOLD}▸ ${step}${RESET}`)

32}

33

Lines 655-695typescript

655 if (confirm.toLowerCase() !== 'y') {

656 log('\nAborted.')

657 process.exit(0)

658 }

659

660 // ── Generate ──

661 logStep('Generating projects...')

662

663

bin/cli.tsView file

Lines 59-99typescript

59 process.exit(code ?? 1)

60 })

61 })

62}

63

64async function runGenerate(args: string[]) {

65 return new Promise<void

dist/index.jsView file

5this file except in compliance with the License. You may obtain a copy of the L6: License at http://www.apache.org/licenses/LICENSE-2.0 L7: ... L14: and limitations under the License. L15: ***************************************************************************** */var Reflect2;(function(Reflect3){(function(factory){var root=typeof globalThis==="object"?globalThis... L16: `).slice(1);for(let line of lines){let match=line.match(/at\s+(?:(.+?)\s+)?$?(.+?):(\d+):(\d+)$?/);if(!match)continue;let[,fnName,filePath,lineNum]=match,fileName=filePath?filePa... L17: `).slice(1,4);for(let stackLine of stackLines)method(` ${dim}${stackLine.trim()}${reset}`)}}}getConsoleMethod(level){switch(level){case"debug":return console.debug.bind(console);c... L18: <defs> ... L31: ${overlayLines} L32: </svg>`}function generatePuzzleChallenge(difficulty){let pieceCount=DIFFICULTY_CONFIG[difficulty].puzzlePieces,pieces=[],correctOrder=[];for(let i=0;i<pieceCount;i++)pieces.push({i... L33: `)&&privateKey.includes("\\n"))privateKey=privateKey.replace(/\\n/g,` ... L100: return {1, count + 1}

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L5

5this file except in compliance with the License. You may obtain a copy of the L6: License at http://www.apache.org/licenses/LICENSE-2.0 L7: ... L14: and limitations under the License. L15: ***************************************************************************** */var Reflect2;(function(Reflect3){(function(factory){var root=typeof globalThis==="object"?globalThis... L16: `).slice(1);for(let line of lines){let match=line.match(/at\s+(?:(.+?)\s+)?$?(.+?):(\d+):(\d+)$?/);if(!match)continue;let[,fnName,filePath,lineNum]=match,fileName=filePath?filePa... L17: `).slice(1,4);for(let stackLine of stackLines)method(` ${dim}${stackLine.trim()}${reset}`)}}}getConsoleMethod(level){switch(level){case"debug":return console.debug.bind(console);c... L18: <defs> ... L31: ${overlayLines} L32: </svg>`}function generatePuzzleChallenge(difficulty){let pieceCount=DIFFICULTY_CONFIG[difficulty].puzzlePieces,pieces=[],correctOrder=[];for(let i=0;i<pieceCount;i++)pieces.push({i... L33: `)&&privateKey.includes("\\n"))privateKey=privateKey.replace(/\\n/g,` ... L100: return {1, count + 1}

Source & flagged code

5 flagged · loading source

infra/scripts/generate-project.tsView file

13import { createInterface } from 'readline/promises' L14: import { spawnSync } from 'child_process' L15:

High

Child Process

Package source references child process execution.

infra/scripts/generate-project.tsView on unpkg · L13

675logStep(`[API] bun install`) L676: const installBe = spawnSync('bun', ['install'], { cwd: beDir, stdio: ['pipe', 'pipe', 'pipe'] }) L677: if (installBe.status === 0) { L678: logSuccess('bun install completed') L679: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

infra/scripts/generate-project.tsView on unpkg · L675

bin/cli.tsView file

79case 'new': { L80: const { scaffold } = await import(join(rootDir, 'infra', 'scripts', 'generate-project.ts')) L81: const infraDir = join(rootDir, 'infra')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.tsView on unpkg · L79

dist/index.jsView file

5this file except in compliance with the License. You may obtain a copy of the L6: License at http://www.apache.org/licenses/LICENSE-2.0 L7: ... L14: and limitations under the License. L15: ***************************************************************************** */var Reflect2;(function(Reflect3){(function(factory){var root=typeof globalThis==="object"?globalThis... L16: `).slice(1);for(let line of lines){let match=line.match(/at\s+(?:(.+?)\s+)?$?(.+?):(\d+):(\d+)$?/);if(!match)continue;let[,fnName,filePath,lineNum]=match,fileName=filePath?filePa... L17: `).slice(1,4);for(let stackLine of stackLines)method(` ${dim}${stackLine.trim()}${reset}`)}}}getConsoleMethod(level){switch(level){case"debug":return console.debug.bind(console);c... L18: <defs> ... L31: ${overlayLines} L32: </svg>`}function generatePuzzleChallenge(difficulty){let pieceCount=DIFFICULTY_CONFIG[difficulty].puzzlePieces,pieces=[],correctOrder=[];for(let i=0;i<pieceCount;i++)pieces.push({i... L33: `)&&privateKey.includes("\\n"))privateKey=privateKey.replace(/\\n/g,` ... L100: return {1, count + 1}

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L5

5this file except in compliance with the License. You may obtain a copy of the L6: License at http://www.apache.org/licenses/LICENSE-2.0 L7: ... L14: and limitations under the License. L15: ***************************************************************************** */var Reflect2;(function(Reflect3){(function(factory){var root=typeof globalThis==="object"?globalThis... L16: `).slice(1);for(let line of lines){let match=line.match(/at\s+(?:(.+?)\s+)?$?(.+?):(\d+):(\d+)$?/);if(!match)continue;let[,fnName,filePath,lineNum]=match,fileName=filePath?filePa... L17: `).slice(1,4);for(let stackLine of stackLines)method(` ${dim}${stackLine.trim()}${reset}`)}}}getConsoleMethod(level){switch(level){case"debug":return console.debug.bind(console);c... L18: <defs> ... L31: ${overlayLines} L32: </svg>`}function generatePuzzleChallenge(difficulty){let pieceCount=DIFFICULTY_CONFIG[difficulty].puzzlePieces,pieces=[],correctOrder=[];for(let i=0;i<pieceCount;i++)pieces.push({i... L33: `)&&privateKey.includes("\\n"))privateKey=privateKey.replace(/\\n/g,` ... L100: return {1, count + 1}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L5

Findings

4 High5 Medium7 Low

HighChild Processinfra/scripts/generate-project.ts

HighShell

HighObfuscated Payload Loaderdist/index.js

HighRuntime Package Installinfra/scripts/generate-project.ts

MediumDynamic Requirebin/cli.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License