registry / openbucket / 0.1.1

openbucket@0.1.1

Turn any local disk or folder into S3-compatible object storage.

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 3.68 MB of source, external domains: 127.0.0.1, 169.254.169.254, fonts.googleapis.com, github.com, jira.mongodb.org, nextjs.org, openbucket-eight.vercel.app, openbucket.local, react.dev, s3-node.openbucket.dev, s3.amazonaws.com, tools.ietf.org, vault.azure.net, vinext.local, www.google.com, www.mongodb.com, www.npmjs.com, www.sitemaps.org, www.w3.org

Source & flagged code

8 flagged

dist/server/index.jsView file

682* When no redirect matches (the common case for ordinary page loads), L683: * matchRedirect previously ran exec() on every one of those regexes — L684: * ~2ms per call, ~2992ms total self-time in profiles.

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L682

dist/cli/main.jsView file

Lines 128-168javascript

128 }

129 }

130 }

131 else if (!childClosed && child.exitCode === null && child.signalCode === null) {

132 child.kill("SIGKILL");

133 }

134 await waitForChildClose(child, 2_000);

135}

136function defaultIO(overrides = {}) {

137 return {

138 stdout: process.stdout,

139 stderr: process.stderr,

140 env: process.env,

141 cwd: () => process.cwd(),

142 homedir,

143 fetch: globalThis.fetch.bind(globalThis),

144 spawn: (command, args, options) => nodeSpawn(command, [...args], options),

145 terminateProcessTree: terminateDetachedProcessTree,

146 sleep: (milliseconds) => new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds)),

147 platform: process.platform,

148 execPath: process.execPath,

149 execArgv: [...process.execArgv],

150 pid: process.pid,

High

Shell

Package source references shell execution.

dist/cli/main.jsView on unpkg · L148

151 cliPath: fileURLToPath(import.meta.url),

152 prompt: defaultAuthPrompt,

153 readStdin: readAuthStdin,

154 ...overrides,

155 };

156}

157function writeLine(writer, value = "") {

158 writer.write(`${value}\n`);

159}

160function optionKey(name) {

161 return name.replace(/-([a-z])/g, (_match, character) => character.toUpperCase());

162}

163function parseOptions(tokens, valueOptions, flagOptions) {

164 const values = new Set(valueOptions);

165 const flags = new Set(flagOptions);

166 const options = {};

167 const positionals = [];

168 let positionalOnly = false;

dist/server/ssr/__vite_rsc_assets_manifest.jsView file

Lines 1-21javascript

1export default {

2 "bootstrapScriptContent": "import(\"/assets/index-PJLTUBAI.js\")",

3 "clientReferenceDeps": {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/ssr/__vite_rsc_assets_manifest.jsView on unpkg · L1

dist/daemon/store.jsView file

Lines 1-39javascript

1import { createHash, randomBytes, randomUUID } from "node:crypto";

2import { createReadStream, createWriteStream } from "node:fs";

3import { appendFile, lstat, mkdir, open as openFile, opendir, readFile, realpath, rename, rm, rmdir, stat, statfs, writeFile, } from "node:fs/promises";

4import { hostname } from

dist/server/assets/service-DAq2zklK.jsView file

4import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/assets/service-DAq2zklK.jsView on unpkg · L4

4Cross-file remote execution chain: dist/server/assets/service-DAq2zklK.js spawns dist/server/index.js; helper contains network access plus dynamic code execution. L4: import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/assets/service-DAq2zklK.jsView on unpkg · L4

examples/python/upload.pyView file

•path = examples/python/upload.py kind = build_helper sizeBytes = 2264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/python/upload.pyView on unpkg

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View file

•path = dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2 kind = high_entropy_blob sizeBytes = 16540 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View on unpkg

Source & flagged code

8 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code