obsidian-tc: Suspicious npm security report (Warn)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

CopyleftLicense

scanned 3 file(s), 2.26 MB of source, external domains: 127.0.0.1, api.cohere.com, api.openai.com, api.voyageai.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

5 flagged

dist/index.jsView file

1import{createRequire as Ve}from"node:module";var ze=Object.create;var{getPrototypeOf:Ie,defineProperty:_Y,getOwnPropertyNames:De}=Object;var Be=Object.prototype.hasOwnProperty;func... L2: `).find((Q)=>Q.includes("IOPlatformUUID"));if(!J)return;let W=J.split('" = "');if(W.length===2)return W[1].slice(0,-1)}catch($){SO$.diag.debug(`error reading machine id: ${$}`)}ret...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1import{createRequire as Ve}from"node:module";var ze=Object.create;var{getPrototypeOf:Ie,defineProperty:_Y,getOwnPropertyNames:De}=Object;var Be=Object.prototype.hasOwnProperty;func... L2: `).find((Q)=>Q.includes("IOPlatformUUID"));if(!J)return;let W=J.split('" = "');if(W.length===2)return W[1].slice(0,-1)}catch($){SO$.diag.debug(`error reading machine id: ${$}`)}ret...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1

1import{createRequire as Ve}from"node:module";var ze=Object.create;var{getPrototypeOf:Ie,defineProperty:_Y,getOwnPropertyNames:De}=Object;var Be=Object.prototype.hasOwnProperty;func... L2: `).find((Q)=>Q.includes("IOPlatformUUID"));if(!J)return;let W=J.split('" = "');if(W.length===2)return W[1].slice(0,-1)}catch($){SO$.diag.debug(`error reading machine id: ${$}`)}ret... ... L13: `,(0,Z5.getIncompatibilityDetails)(X,$),`To resolve the conflict: L14: `,(0,Z5.getConflictResolutionRecipe)(X,$))}return W}}ux.MetricStorageRegistry=kB});var ix=O((nx)=>{Object.defineProperty(nx,"__esModule",{value:!0});nx.MultiMetricStorage=void 0;cl... L15: `:""},this._extScope=$,this._scope=new _6.Scope({parent:$}),this._nodes=[new Zi]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1import{createRequire as Ve}from"node:module";var ze=Object.create;var{getPrototypeOf:Ie,defineProperty:_Y,getOwnPropertyNames:De}=Object;var Be=Object.prototype.hasOwnProperty;func... L2: `).find((Q)=>Q.includes("IOPlatformUUID"));if(!J)return;let W=J.split('" = "');if(W.length===2)return W[1].slice(0,-1)}catch($){SO$.diag.debug(`error reading machine id: ${$}`)}ret... ... L13: `,(0,Z5.getIncompatibilityDetails)(X,$),`To resolve the conflict: L14: `,(0,Z5.getConflictResolutionRecipe)(X,$))}return W}}ux.MetricStorageRegistry=kB});var ix=O((nx)=>{Object.defineProperty(nx,"__esModule",{value:!0});nx.MultiMetricStorage=void 0;cl... L15: `:""},this._extScope=$,this._scope=new _6.Scope({parent:$}),this._nodes=[new Zi]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

22(ts, vault_id, tool_name, caller, duration_ms, result_size, status, error_code, args_hash, event_type) L23: VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(J.ts,J.vault_id??null,J.tool_name??null,J.caller??null,J.duration_ms??null,J.result_size??null,J.status,J.error_code??null,J.args_hash??... L24: `)}var O0=($)=>(J,W,Q,X)=>{let U=Q?{...Q,async:!1}:{async:!1},Y=J._zod.run({value:W,issues:[]},U);if(Y instanceof Promise)throw new l6;if(Y.issues.length){let G=new(X?.Err??$)(Y.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L22

Source & flagged code

5 flagged · loading source

dist/index.jsView file

1import{createRequire as Ve}from"node:module";var ze=Object.create;var{getPrototypeOf:Ie,defineProperty:_Y,getOwnPropertyNames:De}=Object;var Be=Object.prototype.hasOwnProperty;func... L2: `).find((Q)=>Q.includes("IOPlatformUUID"));if(!J)return;let W=J.split('" = "');if(W.length===2)return W[1].slice(0,-1)}catch($){SO$.diag.debug(`error reading machine id: ${$}`)}ret...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1import{createRequire as Ve}from"node:module";var ze=Object.create;var{getPrototypeOf:Ie,defineProperty:_Y,getOwnPropertyNames:De}=Object;var Be=Object.prototype.hasOwnProperty;func... L2: `).find((Q)=>Q.includes("IOPlatformUUID"));if(!J)return;let W=J.split('" = "');if(W.length===2)return W[1].slice(0,-1)}catch($){SO$.diag.debug(`error reading machine id: ${$}`)}ret...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1

1import{createRequire as Ve}from"node:module";var ze=Object.create;var{getPrototypeOf:Ie,defineProperty:_Y,getOwnPropertyNames:De}=Object;var Be=Object.prototype.hasOwnProperty;func... L2: `).find((Q)=>Q.includes("IOPlatformUUID"));if(!J)return;let W=J.split('" = "');if(W.length===2)return W[1].slice(0,-1)}catch($){SO$.diag.debug(`error reading machine id: ${$}`)}ret... ... L13: `,(0,Z5.getIncompatibilityDetails)(X,$),`To resolve the conflict: L14: `,(0,Z5.getConflictResolutionRecipe)(X,$))}return W}}ux.MetricStorageRegistry=kB});var ix=O((nx)=>{Object.defineProperty(nx,"__esModule",{value:!0});nx.MultiMetricStorage=void 0;cl... L15: `:""},this._extScope=$,this._scope=new _6.Scope({parent:$}),this._nodes=[new Zi]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1import{createRequire as Ve}from"node:module";var ze=Object.create;var{getPrototypeOf:Ie,defineProperty:_Y,getOwnPropertyNames:De}=Object;var Be=Object.prototype.hasOwnProperty;func... L2: `).find((Q)=>Q.includes("IOPlatformUUID"));if(!J)return;let W=J.split('" = "');if(W.length===2)return W[1].slice(0,-1)}catch($){SO$.diag.debug(`error reading machine id: ${$}`)}ret... ... L13: `,(0,Z5.getIncompatibilityDetails)(X,$),`To resolve the conflict: L14: `,(0,Z5.getConflictResolutionRecipe)(X,$))}return W}}ux.MetricStorageRegistry=kB});var ix=O((nx)=>{Object.defineProperty(nx,"__esModule",{value:!0});nx.MultiMetricStorage=void 0;cl... L15: `:""},this._extScope=$,this._scope=new _6.Scope({parent:$}),this._nodes=[new Zi]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

22(ts, vault_id, tool_name, caller, duration_ms, result_size, status, error_code, args_hash, event_type) L23: VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(J.ts,J.vault_id??null,J.tool_name??null,J.caller??null,J.duration_ms??null,J.result_size??null,J.status,J.error_code??null,J.args_hash??... L24: `)}var O0=($)=>(J,W,Q,X)=>{let U=Q?{...Q,async:!1}:{async:!1},Y=J._zod.run({value:W,issues:[]},U);if(Y instanceof Promise)throw new l6;if(Y.issues.length){let G=new(X?.Err??$)(Y.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L22

Findings

4 High3 Medium7 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License