registry / pkg-sentinel / 0.1.1

pkg-sentinel@0.1.1

Production-quality npm supply-chain security CLI — trust analysis, health scoring, install script inspection, typosquatting detection, and AI-powered risk summaries.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 416 KB of source, external domains: api.github.com, api.npmjs.org, github.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 539-579javascript

539 }

540 return versionData.dist.tarball;

541 }

542 async getPackageFiles(packageName, version) {

543 const metadata = await this.getPackageMetadata(packageName);

544 const versionData = metadata.versions[version];

545 if (!versionData) {

546 throw new Error(

547 `Version ${version} not found for package ${packageName}`

548 );

549 }

550 const files = /* @__PURE__ */ new Map();

551 files.set("package.json", JSON.stringify(versionData, null, 2));

552 try {

553 const tarballUrl = versionData.dist.tarball;

554 const response = await fetch(tarballUrl);

555 if (!response.ok) {

556 throw new Error(`Failed to fetch tarball from ${tarballUrl}`);

557 }

558 const arrayBuffer = await response.arrayBuffer();

559 const buffer = Buffer.from(arrayBuffer);

560 const { Readable } = await import('stream');

561 const tar = await import('tar');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L559

562 await new Promise((resolve, reject) => {

563 const readable = Readable.from(buffer);

564 const parser = new tar.Parser();

565 parser.on("entry", (entry) => {

566 const isInteresting = entry.type === "File" && (entry.path.endsWith(".js") || entry.path.endsWith(".ts") || entry.path.endsWith(".json") || entry.path.endsWith(".sh") || entry.path.endsWith(".bat"));

567 if (!isInteresting) {

568 entry.resume();

569 return;

570 }

571 const chunks = [];

572 entry.on("data", (chunk) => chunks.push(chunk));

573 entry.on("end", () => {

574 const content = Buffer.concat(chunks).toString("utf-8");

575 const cleanPath = entry.path.replace(/^package\//, "");

576 files.set(cleanPath, content);

577 });

578 });

579 parser.on("end", () => resolve());

Lines 1879-1919javascript

1879 ctx.report({

1880 detector: "exec",

1881 type: "dangerous-command-string",

1882 severity: "high",

1883 description: `Contains dangerous command reference: "${cmd}" in "${value}"`,

1884 location: path.node.loc?.start

1885 });

1886 break;

1887 }

dist/index.cjsView file

Lines 33-73javascript

33};

34function compareSeverity(a, b) {

35 return SEVERITY_ORDER[a] - SEVERITY_ORDER[b];

36}

37var AnalysisCategory = /* @__PURE__ */ ((AnalysisCategory2) => {

38 AnalysisCategory2["Health"

Source & flagged code

4 flagged · loading source

dist/index.jsView file

559const buffer = Buffer.from(arrayBuffer); L560: const { Readable } = await import('stream'); L561: const tar = await import('tar');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L559

1899name = "obfuscation"; L1900: description = "Detects eval(), dynamic code execution, obfuscated code, and high-entropy strings"; L1901: getVisitors(ctx) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L1899

dist/index.cjsView file

53})(AnalysisStatus || {}); L54: var ExitCode = /* @__PURE__ */ ((ExitCode2) => { L55: ExitCode2[ExitCode2["Success"] = 0] = "Success"; ... L143: const patterns = [ L144: // https://github.com/owner/repo L145: /github\.com\/([^/]+)\/([^/\s#?.]+)/, ... L331: packageVersion: context.packageVersion, L332: npmData: context.npmMetadata, L333: githubData: context.githubData, ... L406: if (contentType.includes("application/json")) { L407: data = await response.json(); L408: } else {

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L53

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.cjsView on unpkg · L53

Findings

1 High5 Medium6 Low

HighObfuscated Payload Loaderdist/index.cjs

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.cjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 539-579javascript

539 }

540 return versionData.dist.tarball;

541 }

542 async getPackageFiles(packageName, version) {

543 const metadata = await this.getPackageMetadata(packageName);

544 const versionData = metadata.versions[version];

545 if (!versionData) {

546 throw new Error(

547 `Version ${version} not found for package ${packageName}`

548 );

549 }

550 const files = /* @__PURE__ */ new Map();

551 files.set("package.json", JSON.stringify(versionData, null, 2));

552 try {

553 const tarballUrl = versionData.dist.tarball;

554 const response = await fetch(tarballUrl);

555 if (!response.ok) {

556 throw new Error(`Failed to fetch tarball from ${tarballUrl}`);

557 }

558 const arrayBuffer = await response.arrayBuffer();

559 const buffer = Buffer.from(arrayBuffer);

560 const { Readable } = await import('stream');

561 const tar = await import('tar');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L559

562 await new Promise((resolve, reject) => {

563 const readable = Readable.from(buffer);

564 const parser = new tar.Parser();

565 parser.on("entry", (entry) => {

567 if (!isInteresting) {

568 entry.resume();

569 return;

570 }

571 const chunks = [];

572 entry.on("data", (chunk) => chunks.push(chunk));

573 entry.on("end", () => {

574 const content = Buffer.concat(chunks).toString("utf-8");

575 const cleanPath = entry.path.replace(/^package\//, "");

576 files.set(cleanPath, content);

577 });

578 });

579 parser.on("end", () => resolve());

Lines 1879-1919javascript

1879 ctx.report({

1880 detector: "exec",

1881 type: "dangerous-command-string",

1882 severity: "high",

1883 description: `Contains dangerous command reference: "${cmd}" in "${value}"`,

1884 location: path.node.loc?.start

1885 });

1886 break;

1887 }

dist/index.cjsView file

Lines 33-73javascript

33};

34function compareSeverity(a, b) {

35 return SEVERITY_ORDER[a] - SEVERITY_ORDER[b];

36}

37var AnalysisCategory = /* @__PURE__ */ ((AnalysisCategory2) => {

38 AnalysisCategory2["Health"