numbors@1.1.10
Numbors CLI - agent-first accounting. Create invoices, reconcile banks, manage expenses. 60 MCP tools. As easy as talking.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
DynamicRequireEnvironmentVars
MinifiedObfuscated
NoLicense
Source & flagged code
2 flaggedbin/cli.jsView file
2try {
L3: require('../dist/main');
L4: } catch (e) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L2dist/mcp-tools.jsView file
1(function(_0x522f20,_0x17df41){function _0x58fa57(_0x3f1b4f,_0x154a7e){return a0_0x2053(_0x154a7e-0xfc,_0x3f1b4f);}function _0x1758ac(_0x51a4dd,_0x346142){return a0_0x2053(_0x51a4d...
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/mcp-tools.jsView on unpkg · L1Findings
2 High3 Medium3 Low
HighObfuscated Payload Loaderdist/mcp-tools.js
HighObfuscated
MediumDynamic Requirebin/cli.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to numbors@1.1.10.
See all versions of numbors for other recorded verdicts.
- Review the evidence and your use of numbors@1.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.