Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/hooks/install.js install 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/hooks/install.js install 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/hooks/session-end.jsView file
47while (current !== workspaceRoot && current !== path.parse(current).root) {
L48: const pkgPath = path.join(current, 'package.json');
L49: if (fs.existsSync(pkgPath)) {
L50: try {
L51: const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
L52: return pkg.name || path.basename(current);
...
L217: text = text.replace(/<command-args>[\s\S]*?<\/command-args>/g, '').trim();
L218: text = text.replace(/<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, '').trim();
L219: if (text.length < 5)
...
L546: *
L547: * 예: https://docs.google.com/forms/d/e/1FAIpQLScm.../viewform
L548: * → https://docs.google.com/forms/...
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/hooks/session-end.jsView on unpkg · L47Findings
1 High3 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/hooks/session-end.js
LowFilesystem
LowHigh Entropy Strings