Static Scan Results
scanned 1d ago · by rust-scannerStatic analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcescript/postinstall.mjsView file
2L3: import childProcess from "child_process"
L4: import fs from "fs"
High
Child Process
Package source references child process execution.
script/postinstall.mjsView on unpkg · L258L59: for (const executable of ["powershell.exe", "pwsh.exe", "pwsh", "powershell"]) {
L60: try {
High
script/time.tsView file
4const toDynamicallyImport = path.join(process.cwd(), process.argv[2])
L5: await import(toDynamicallyImport)
L6: console.log(performance.now())
Medium
Dynamic Require
Package source references dynamic require/import behavior.
script/time.tsView on unpkg · L4src/lsp/server.tsView file
1import type { ChildProcessWithoutNullStreams } from "child_process"
L2: import path from "path"
...
L22: const run = (cmd: string[], opts: Process.RunOptions = {}) => Process.run(cmd, { ...opts, nothrow: true })
L23: const output = (cmd: string[], opts: Process.RunOptions = {}) => Process.text(cmd, { ...opts, nothrow: true })
L24:
...
L117: root: NearestRoot(
L118: ["package-lock.json", "bun.lockb", "bun.lock", "pnpm-lock.yaml", "yarn.lock"],
L119: ["deno.json", "deno.jsonc"],
...
L129: env: {
L130: ...process.env,
L131: },
...
L182: if (flags.disableLspDownload) return
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
src/lsp/server.tsView on unpkg · L11import type { ChildProcessWithoutNullStreams } from "child_process"
L2: import path from "path"
...
L22: const run = (cmd: string[], opts: Process.RunOptions = {}) => Process.run(cmd, { ...opts, nothrow: true })
L23: const output = (cmd: string[], opts: Process.RunOptions = {}) => Process.text(cmd, { ...opts, nothrow: true })
L24:
...
L117: root: NearestRoot(
L118: ["package-lock.json", "bun.lockb", "bun.lock", "pnpm-lock.yaml", "yarn.lock"],
L119: ["deno.json", "deno.jsonc"],
...
L129: env: {
L130: ...process.env,
L131: },
...
L182: if (flags.disableLspDownload) return
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/lsp/server.tsView on unpkg · L1test/server/auth.test.tsView file
47patternName = generic_password
severity = medium
line = 47
matchedText = expect(S...al({
Medium
Secret Pattern
Hardcoded password in test/server/auth.test.ts
test/server/auth.test.tsView on unpkg · L47test/server/httpapi-listen.test.tsView file
18patternName = generic_password
severity = medium
line = 18
matchedText = const au...t" }
Medium
Secret Pattern
Hardcoded password in test/server/httpapi-listen.test.ts
test/server/httpapi-listen.test.tsView on unpkg · L18Findings
1 Critical3 High6 Medium5 Low
CriticalCommand Output Exfiltrationsrc/lsp/server.ts
HighChild Processscript/postinstall.mjs
HighShellscript/postinstall.mjs
HighSandbox Evasion Gated Capabilitysrc/lsp/server.ts
MediumDynamic Requirescript/time.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterntest/server/auth.test.ts
MediumSecret Patterntest/server/httpapi-listen.test.ts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings