numbors@1.1.6
Numbors CLI - agent-first accounting. Create invoices, reconcile banks, manage expenses. 60 MCP tools. As easy as talking.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
DynamicRequireEnvironmentVars
MinifiedObfuscated
NoLicense
Source & flagged code
2 flaggedbin/cli.jsView file
2try {
L3: require('../dist/main');
L4: } catch (e) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L2dist/mcp-tools.jsView file
1function a0_0x32d7(){var _0xa21d92=['\x65\x71\x56\x63\x4e\x4c\x4c\x71','\x44\x78\x4b\x77\x57\x37\x52\x64\x50\x61','\x75\x53\x6f\x48\x62\x30\x43','\x57\x36\x4f\x62\x57\x50\x42\x63\x...
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/mcp-tools.jsView on unpkg · L1Findings
2 High3 Medium3 Low
HighObfuscated Payload Loaderdist/mcp-tools.js
HighObfuscated
MediumDynamic Requirebin/cli.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to numbors@1.1.6.
See all versions of numbors for other recorded verdicts.
- Review the evidence and your use of numbors@1.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.