registry / ocean-brain / 0.12.2
ocean-brain@0.12.2
<!-- npm package README for the public ocean-brain CLI.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings
Source & flagged code
3 flaggedpackage.jsonView file
•scripts.postinstall = node ./scripts/postinstall-prisma.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgserver/client/dist/assets/NotePropertiesPanel-Cu3RgDic.jsView file
1import{j as J,q as Et,g as Kt,r as lt}from"./floating-ui.react-dom-BWTnA00G.js";import{a as Ht,n as Yt,h as qt}from"./useNoteMutate-xEIypxi5.js";import{c as Ct,u as Vt,q as Nt,W as...
L2: \0`,K+=o(A,2),K+=T.magic,K+=o(w,2),K+=o(E,2),K+=o($.crc32,4),K+=o($.compressedSize,4),K+=o($.uncompressedSize,4),K+=o(U.length,2),K+=o(N.length,2),{fileRecord:_.LOCAL_FILE_HEADER+K...
Low
Eval
Package source references a known benign dynamic code generation pattern.
server/client/dist/assets/NotePropertiesPanel-Cu3RgDic.jsView on unpkg · L1dist/index.jsView file
Findings
1 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalserver/client/dist/assets/NotePropertiesPanel-Cu3RgDic.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to ocean-brain@0.12.2.
See all versions of ocean-brain for other recorded verdicts.
- Review the evidence and your use of ocean-brain@0.12.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.