Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
dev/client/web-chat/dist/assets/index-6GA21osP.js3.84 MB file, sampled 256 KB
NetworkChildProcessHighEntropyStringsMinifiedUrlStringsreactjs.orgwww.w3.org
dev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.js2.60 MB file, sampled 256 KB
NetworkChildProcessHighEntropyStringsMinifiedUrlStringswww.w3.org
Source & flagged code
10 flagged · loading sourcedev/client/web-chat/dist/pdf.worker.min.jsView file
21patternName = aws_access_key
severity = critical
line = 21
matchedText = */var e=...er};
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dev/client/web-chat/dist/pdf.worker.min.jsView on unpkg · L2121patternName = aws_access_key
severity = critical
line = 21
matchedText = */var e=...er};
Critical
Secret Pattern
AWS access key ID in dev/client/web-chat/dist/pdf.worker.min.js
dev/client/web-chat/dist/pdf.worker.min.jsView on unpkg · L2120* JavaScript code in this page
L21: */var e={d:(t,i)=>{for(var a in i)e.o(i,a)&&!e.o(t,a)&&Object.defineProperty(t,a,{enumerable:!0,get:i[a]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t)},__webpack_exports__=...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dev/client/web-chat/dist/pdf.worker.min.jsView on unpkg · L20host-service/host-telemetry.mjsView file
11L12: const require = createRequire(import.meta.url);
L13: const hostServicePackage = require("./package.json");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
host-service/host-telemetry.mjsView on unpkg · L11host-service/config.mjsView file
1import { execFileSync } from "child_process";
L2: import {
...
L29: export function getConfigDir() {
L30: return process.env.OYSTERUN_CONFIG_DIR || join(homedir(), ".oysterun");
L31: }
...
L70:
L71: function resolveSystemLocalHostName() {
L72: try {
...
L105: export const LEGACY_FALLBACK_HOST_PORT = 3456;
L106: export const PRODUCT_CLOUD_BACKEND_URL = "https://api.oysterun.com";
L107: export const PRODUCT_CLOUD_BACKEND_STAGE = "prod";
...
L609: function cloneValue(value) {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
host-service/config.mjsView on unpkg · L1dev/client/web-chat/dist/public/element-call/assets/vision_wasm_internal-TmjHuG4I.wasmView file
•path = dev/client/web-chat/dist/public/element-call/assets/vision_wasm_internal-TmjHuG4I.wasm
kind = wasm_module
sizeBytes = 9574032
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
dev/client/web-chat/dist/public/element-call/assets/vision_wasm_internal-TmjHuG4I.wasmView on unpkgtool_scripts/restart_oysterun.shView file
•path = tool_scripts/restart_oysterun.sh
kind = build_helper
sizeBytes = 212
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tool_scripts/restart_oysterun.shView on unpkgdev/client/web-chat/dist/public/element-call/assets/dog-BoQdnF-w.mp3View file
•path = dev/client/web-chat/dist/public/element-call/assets/dog-BoQdnF-w.mp3
kind = high_entropy_blob
sizeBytes = 11702
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dev/client/web-chat/dist/public/element-call/assets/dog-BoQdnF-w.mp3View on unpkgdev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.jsView file
•path = dev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.js
kind = oversized_source_file
sizeBytes = 2729281
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.jsView on unpkghost-service/adapters/codex-app-server-adapter.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = oysterun@1.4.5
matchedIdentity = npm:b3lzdGVydW4:1.4.5
similarity = 0.975
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
host-service/adapters/codex-app-server-adapter.mjsView on unpkgFindings
2 Critical4 High7 Medium8 Low
CriticalCritical Secretdev/client/web-chat/dist/pdf.worker.min.js
CriticalSecret Patterndev/client/web-chat/dist/pdf.worker.min.js
HighSandbox Evasion Gated Capabilityhost-service/config.mjs
HighShips High Entropy Blobdev/client/web-chat/dist/public/element-call/assets/dog-BoQdnF-w.mp3
HighOversized Source Filedev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.js
HighPrevious Version Dangerous Deltahost-service/adapters/codex-app-server-adapter.mjs
MediumDynamic Requirehost-service/host-telemetry.mjs
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Wasm Moduledev/client/web-chat/dist/public/element-call/assets/vision_wasm_internal-TmjHuG4I.wasm
MediumShips Build Helpertool_scripts/restart_oysterun.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldev/client/web-chat/dist/pdf.worker.min.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License