registry / oysterun / 1.5.1

oysterun@1.5.1

Oysterun Host installer and local service

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 22 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 142 file(s), 6.72 MB of source, external domains: 127.0.0.1, api.oysterun.com, api.telegram.org, example.com, github.com, ns.adobe.com, oysterun.com, oysterun.local, reactjs.org, registry.npmjs.org, us.i.posthog.com, voieechcontent.sgp1.digitaloceanspaces.com, www.w3.org, www.xfa.org, your-device.your-tailnet.ts.net, your-mac.local

Oversized source lightweight scan

dev/client/web-chat/dist/assets/index-BhxLAseE.js3.85 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStrings

Source & flagged code

11 flagged

package.jsonView file

Lines 1-30json

2 "name": "oysterun",

3 "version": "1.5.1",

4 "type": "module",

5 "description": "Oysterun Host installer and local service",

6 "bin": {

7 "oysterun": "bin/oysterun.mjs"

8 },

9 "scripts": {

10 "postinstall": "node tool_scripts/verify_oysterun_runtime.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

11 "setup": "node host-service/setup.mjs --release-setup",

12 "service:install": "tool_scripts/oysterun_release_service.sh install",

13 "service:start": "tool_scripts/oysterun_release_service.sh start",

14 "service:stop": "tool_scripts/oysterun_release_service.sh stop",

15 "service:restart": "tool_scripts/oysterun_release_service.sh restart",

16 "service:status": "tool_scripts/oysterun_release_service.sh status",

17 "service:logs": "tool_scripts/oysterun_release_service.sh logs",

18 "service:uninstall": "tool_scripts/oysterun_release_service.sh uninstall"

19 },

20 "files": [

21 "bin/",

22 "host-service/",

23 "tool_scripts/",

24 "dev/client/web/",

25 "dev/client/web-chat/dist/",

26 "dev/client/web-chat/oysterun-release-prebuilt.marker",

27 "static/",

28 "docs/routec/",

29 "README.md"

30 ],

dev/client/web-chat/dist/pdf.worker.min.jsView file

21patternName = aws_access_key severity = critical line = 21 matchedText = */var e=...er};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dev/client/web-chat/dist/pdf.worker.min.jsView on unpkg · L21

21patternName = aws_access_key severity = critical line = 21 matchedText = */var e=...er};

Critical

Secret Pattern

AWS access key ID in dev/client/web-chat/dist/pdf.worker.min.js

dev/client/web-chat/dist/pdf.worker.min.jsView on unpkg · L21

20* JavaScript code in this page L21: */var e={d:(t,i)=>{for(var a in i)e.o(i,a)&&!e.o(t,a)&&Object.defineProperty(t,a,{enumerable:!0,get:i[a]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t)},__webpack_exports__=...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dev/client/web-chat/dist/pdf.worker.min.jsView on unpkg · L20

tool_scripts/verify_oysterun_runtime.mjsView file

Lines 20-60javascript

20 return result;

21}

23export function verifyOysterunRuntime({ packageRoot, expectedVersion = null }) {

24 const resolvedPackageRoot

host-service/config.mjsView file

Lines 1-21javascript

1import { execFileSync } from "child_process";

2import {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

host-service/config.mjsView on unpkg · L1

3 readFileSync,

4 existsSync,

5 mkdirSync,

6 rmSync,

7 statSync,

dev/client/web-chat/dist/public/element-call/assets/vision_wasm_internal-TmjHuG4I.wasmView file

•path = dev/client/web-chat/dist/public/element-call/assets/vision_wasm_internal-TmjHuG4I.wasm kind = wasm_module sizeBytes = 9574032 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dev/client/web-chat/dist/public/element-call/assets/vision_wasm_internal-TmjHuG4I.wasmView on unpkg

tool_scripts/restart_oysterun.shView file

•path = tool_scripts/restart_oysterun.sh kind = build_helper sizeBytes = 212 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tool_scripts/restart_oysterun.shView on unpkg

dev/client/web-chat/dist/public/element-call/assets/dog-BoQdnF-w.mp3View file

•path = dev/client/web-chat/dist/public/element-call/assets/dog-BoQdnF-w.mp3 kind = high_entropy_blob sizeBytes = 11702 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dev/client/web-chat/dist/public/element-call/assets/dog-BoQdnF-w.mp3View on unpkg

dev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.jsView file

•path = dev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.js kind = oversized_source_file sizeBytes = 2729281 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.jsView on unpkg

host-service/server.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = oysterun@1.5.0 matchedIdentity = npm:b3lzdGVydW4:1.5.0 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

host-service/server.mjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node tool_scripts/verify_oysterun_runtime.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dev/client/web-chat/dist/pdf.worker.min.jsView file

21patternName = aws_access_key severity = critical line = 21 matchedText = */var e=...er};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dev/client/web-chat/dist/pdf.worker.min.jsView on unpkg · L21

21patternName = aws_access_key severity = critical line = 21 matchedText = */var e=...er};

Critical

Secret Pattern

AWS access key ID in dev/client/web-chat/dist/pdf.worker.min.js

dev/client/web-chat/dist/pdf.worker.min.jsView on unpkg · L21

Findings

2 Critical5 High7 Medium8 Low

CriticalCritical Secretdev/client/web-chat/dist/pdf.worker.min.js

CriticalSecret Patterndev/client/web-chat/dist/pdf.worker.min.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityhost-service/config.mjs

HighShips High Entropy Blobdev/client/web-chat/dist/public/element-call/assets/dog-BoQdnF-w.mp3

HighOversized Source Filedev/client/web-chat/dist/public/element-call/assets/index-BAfhaCa-.js

HighPrevious Version Dangerous Deltahost-service/server.mjs

MediumDynamic Requiretool_scripts/verify_oysterun_runtime.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware