registry / openbucket / 0.1.7

openbucket@0.1.7

Turn any local disk or folder into S3-compatible object storage.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 3.70 MB of source, external domains: 127.0.0.1, 169.254.169.254, developers.cloudflare.com, fonts.googleapis.com, github.com, jira.mongodb.org, nextjs.org, openbucket-eight.vercel.app, openbucket.local, react.dev, s3.amazonaws.com, tools.ietf.org, vault.azure.net, vinext.local, www.google.com, www.mongodb.com, www.npmjs.com, www.sitemaps.org, www.w3.org

Source & flagged code

8 flagged

dist/server/index.jsView file

682* When no redirect matches (the common case for ordinary page loads), L683: * matchRedirect previously ran exec() on every one of those regexes — L684: * ~2ms per call, ~2992ms total self-time in profiles.

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L682

dist/cli/main.jsView file

Lines 129-169javascript

129 }

130 }

131 }

132 else if (!childClosed && child.exitCode === null && child.signalCode === null) {

133 child.kill("SIGKILL");

134 }

135 await waitForChildClose(child, 2_000);

136}

137function defaultIO(overrides = {}) {

138 return {

139 stdout: process.stdout,

140 stderr: process.stderr,

141 env: process.env,

142 cwd: () => process.cwd(),

143 homedir,

144 fetch: globalThis.fetch.bind(globalThis),

145 spawn: (command, args, options) => nodeSpawn(command, [...args], options),

146 terminateProcessTree: terminateDetachedProcessTree,

147 sleep: (milliseconds) => new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds)),

148 platform: process.platform,

149 execPath: process.execPath,

150 execArgv: [...process.execArgv],

151 pid: process.pid,

High

Shell

Package source references shell execution.

dist/cli/main.jsView on unpkg · L149

152 cliPath: fileURLToPath(import.meta.url),

153 prompt: defaultAuthPrompt,

154 readStdin: readAuthStdin,

155 ...overrides,

156 };

157}

158function writeLine(writer, value = "") {

159 writer.write(`${value}\n`);

160}

161function optionKey(name) {

162 return name.replace(/-([a-z])/g, (_match, character) => character.toUpperCase());

163}

164function parseOptions(tokens, valueOptions, flagOptions) {

165 const values = new Set(valueOptions);

166 const flags = new Set(flagOptions);

167 const options = {};

168 const positionals = [];

169 let positionalOnly = false;

dist/server/ssr/__vite_rsc_assets_manifest.jsView file

Lines 1-21javascript

1export default {

2 "bootstrapScriptContent": "import(\"/assets/index-B8RVxyGf.js\")",

3 "clientReferenceDeps": {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/ssr/__vite_rsc_assets_manifest.jsView on unpkg · L1

dist/daemon/store.jsView file

Lines 1-39javascript

1import { createHash, randomBytes, randomUUID } from "node:crypto";

2import { createReadStream, createWriteStream } from "node:fs";

3import { appendFile, lstat, mkdir, open as openFile, opendir, readFile, realpath, rename, rm, rmdir, stat, statfs, writeFile, } from "node:fs/promises";

4import { hostname } from

dist/server/assets/service-BlSD6pGH.jsView file

4import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

4Cross-file remote execution chain: dist/server/assets/service-BlSD6pGH.js spawns dist/server/index.js; helper contains network access plus dynamic code execution. L4: import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

examples/python/upload.pyView file

•path = examples/python/upload.py kind = build_helper sizeBytes = 2264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/python/upload.pyView on unpkg

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View file

•path = dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2 kind = high_entropy_blob sizeBytes = 16540 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View on unpkg

Source & flagged code

8 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code