numbors@1.1.8
Numbors CLI - agent-first accounting. Create invoices, reconcile banks, manage expenses. 60 MCP tools. As easy as talking.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
DynamicRequireEnvironmentVars
MinifiedObfuscated
NoLicense
Source & flagged code
2 flaggedbin/cli.jsView file
2try {
L3: require('../dist/main');
L4: } catch (e) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L2dist/mcp-tools.jsView file
1(function(_0x321ce0,_0x47f000){function _0x1a7259(_0x2f3e4b,_0x40c84a){return a0_0x5aa5(_0x40c84a- -0x3a2,_0x2f3e4b);}function _0x47436c(_0x5f205b,_0x304c1b){return a0_0x5aa5(_0x5f...
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/mcp-tools.jsView on unpkg · L1Findings
2 High3 Medium3 Low
HighObfuscated Payload Loaderdist/mcp-tools.js
HighObfuscated
MediumDynamic Requirebin/cli.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to numbors@1.1.8.
See all versions of numbors for other recorded verdicts.
- Review the evidence and your use of numbors@1.1.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.