registry / pnpm-pub / 0.2.0

pnpm-pub@0.2.0

Desktop-level local daemon proxy and productivity tool for high-frequency NPM package authors.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 77 file(s), 2.68 MB of source, external domains: 127.0.0.1, api.npmjs.org, bitbucket.org, codeberg.org, gitcode.com, gitee.com, github.com, gitlab.com, gravatar.com, icons.duckduckgo.com, json-schema.org, registry.npmjs.org, scanapp.org, svelte.dev, twitter.com, www.npmjs.com, www.w3.org, yargs.js.org

Source & flagged code

9 flagged

dist/daemon.jsView file

3import net from "node:net"; L4: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L5: import fs, { appendFileSync, createReadStream, createWriteStream, existsSync, mkdirSync, promises, readFileSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/daemon.jsView on unpkg · L3

14import { StringDecoder } from "node:string_decoder"; L15: import process$1, { execArgv, execPath, hrtime, platform } from "node:process"; L16: import tty from "node:tty";

High

Shell

Package source references shell execution.

dist/daemon.jsView on unpkg · L14

2Cross-file remote execution chain: dist/daemon.js spawns dist/paths-umPyi7PZ.js; helper contains network access plus dynamic code execution. L2: import { createRequire } from "node:module"; L3: import net from "node:net"; L4: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L5: import fs, { appendFileSync, createReadStream, createWriteStream, existsSync, mkdirSync, promises, readFileSync, statSync, writeFileSync } from "node:fs"; ... L11: import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events"; L12: import { createCipheriv, createDecipheriv, createHash, pbkdf2Sync, randomBytes, randomUUID } from "node:crypto"; L13: import { gunzip } from "node:zlib"; ... L980: * Prefers `pnpm pack` (this tool's namesake) and falls back to `npm pack`, L981: * matching the spec's promise of 1:1 compatibility with `pnpm publish` L982: * (Chapter 1.3.1 / 7.1.2). The produced tarball is returned as bytes so the ... L988: const parsed = JSON.parse(text); L989: if (!isJsonObject(parsed)) throw new Error("Invalid package.json metadata.");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon.jsView on unpkg · L2

2import { createRequire } from "node:module"; L3: import net from "node:net"; L4: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L5: import fs, { appendFileSync, createReadStream, createWriteStream, existsSync, mkdirSync, promises, readFileSync, statSync, writeFileSync } from "node:fs"; ... L11: import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events"; L12: import { createCipheriv, createDecipheriv, createHash, pbkdf2Sync, randomBytes, randomUUID } from "node:crypto"; L13: import { gunzip } from "node:zlib"; ... L980: * Prefers `pnpm pack` (this tool's namesake) and falls back to `npm pack`, L981: * matching the spec's promise of 1:1 compatibility with `pnpm publish` L982: * (Chapter 1.3.1 / 7.1.2). The produced tarball is returned as bytes so the ... L988: const parsed = JSON.parse(text); L989: if (!isJsonObject(parsed)) throw new Error("Invalid package.json metadata.");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/daemon.jsView on unpkg · L2

dist/paths-umPyi7PZ.jsView file

Lines 297-337javascript

297 const mergedDescriptors = {};

298 for (const def of defs) {

299 const descriptors = Object.getOwnPropertyDescriptors(def);

300 Object.assign(mergedDescriptors, descriptors);

301 }

302

dist/webui/_app/immutable/nodes/0.D_orl_nV.jsView file

Lines 1-9javascript

1import{A as e,At as t,B as n,C as r,Ct as i,D as a,Dt as o,Et as s,F as c,H as l,K as u,L as d,Lt as f,M as p,Mt as m,N as h,Nt as g,O as _,Pt as v,Q

dist/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { H as readPackageVersion, K as isIpcFrame, U as FrameReader, W as encodeFrame, X as __require, c as socketPath, n as daemonLogPath, r as ensureAppDirs } from "./paths-umPyi7PZ.js";

3import net from "node:net";

4import { execFile, spawn } from "node:child_process"

dist/prebuilds/keytar/prebuilds/win32-arm64/keytar.nodeView file

•path = [redacted]-arm64/keytar.node kind = native_binary sizeBytes = 159232 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/prebuilds/keytar/prebuilds/win32-arm64/keytar.nodeView on unpkg

dist/webui/fonts/Geist-Variable.woff2View file

•path = dist/webui/fonts/Geist-Variable.woff2 kind = high_entropy_blob sizeBytes = 69652 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/webui/fonts/Geist-Variable.woff2View on unpkg

Source & flagged code

9 flagged · loading source

dist/daemon.jsView file

High

Child Process

Package source references child process execution.

dist/daemon.jsView on unpkg · L3

14import { StringDecoder } from "node:string_decoder"; L15: import process$1, { execArgv, execPath, hrtime, platform } from "node:process"; L16: import tty from "node:tty";

High

Shell

Package source references shell execution.

dist/daemon.jsView on unpkg · L14

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon.jsView on unpkg · L2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/daemon.jsView on unpkg · L2

dist/paths-umPyi7PZ.jsView file

317try { L318: new Function(""); L319: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/paths-umPyi7PZ.jsView on unpkg · L317

dist/webui/_app/immutable/nodes/0.D_orl_nV.jsView file

8transition: none !important; L9: }`)),hr)}function _r(e,t=!1){if(typeof document>`u`)return;if(!mr){mr=!0,e();return}if(typeof window<`u`&&window.__vitest_worker__){e();return}clearTimeout(fr),clearTimeout(pr);let...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webui/_app/immutable/nodes/0.D_orl_nV.jsView on unpkg · L8

dist/cli.jsView file

2import { H as readPackageVersion, K as isIpcFrame, U as FrameReader, W as encodeFrame, X as __require, c as socketPath, n as daemonLogPath, r as ensureAppDirs } from "./paths-umPyi... L3: import net from "node:net"; L4: import { execFile, spawn } from "node:child_process"; L5: import fs from "node:fs"; ... L203: /* istanbul ignore next: depends on terminal */ L204: if (typeof process === "object" && process.stdout && process.stdout.columns) return process.stdout.columns; L205: return 80; ... L1041: var _a, _b, _c; L1042: const minNodeVersion = process && process.env && process.env.YARGS_MIN_NODE_VERSION ? Number(process.env.YARGS_MIN_NODE_VERSION) : 12; L1043: const nodeVersion = (_b = (_a = process === null || process === void 0 ? void 0 : process.versions) === null || _a === void 0 ? void 0 : _a.node) !== null && _b !== void 0 ? _b : (... ... L1057: if (typeof __require !== "undefined") return __require(path); L1058: else if (path.match(/\.json$/)) return JSON.parse(readFileSync$1(path, "utf8"));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L2

dist/prebuilds/keytar/prebuilds/win32-arm64/keytar.nodeView file

•path = [redacted]-arm64/keytar.node kind = native_binary sizeBytes = 159232 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/prebuilds/keytar/prebuilds/win32-arm64/keytar.nodeView on unpkg

dist/webui/fonts/Geist-Variable.woff2View file

•path = dist/webui/fonts/Geist-Variable.woff2 kind = high_entropy_blob sizeBytes = 69652 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/webui/fonts/Geist-Variable.woff2View on unpkg

Findings

4 High7 Medium7 Low

HighChild Processdist/daemon.js

HighShelldist/daemon.js

HighCross File Remote Execution Contextdist/daemon.js

HighShips High Entropy Blobdist/webui/fonts/Geist-Variable.woff2

MediumDynamic Requiredist/webui/_app/immutable/nodes/0.D_orl_nV.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumShips Native Binarydist/prebuilds/keytar/prebuilds/win32-arm64/keytar.node

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/paths-umPyi7PZ.js

LowWeak Cryptodist/daemon.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/daemon.jsView file

High

Child Process

Package source references child process execution.

dist/daemon.jsView on unpkg · L3

14import { StringDecoder } from "node:string_decoder"; L15: import process$1, { execArgv, execPath, hrtime, platform } from "node:process"; L16: import tty from "node:tty";

High

Shell

Package source references shell execution.

dist/daemon.jsView on unpkg · L14

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon.jsView on unpkg · L2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/daemon.jsView on unpkg · L2

dist/paths-umPyi7PZ.jsView file

Lines 297-337javascript

297 const mergedDescriptors = {};

298 for (const def of defs) {

299 const descriptors = Object.getOwnPropertyDescriptors(def);

300 Object.assign(mergedDescriptors, descriptors);

301 }

302

dist/webui/_app/immutable/nodes/0.D_orl_nV.jsView file

Lines 1-9javascript

1import{A as e,At as t,B as n,C as r,Ct as i,D as a,Dt as o,Et as s,F as c,H as l,K as u,L as d,Lt as f,M as p,Mt as m,N as h,Nt as g,O as _,Pt as v,Q

dist/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { H as readPackageVersion, K as isIpcFrame, U as FrameReader, W as encodeFrame, X as __require, c as socketPath, n as daemonLogPath, r as ensureAppDirs } from "./paths-umPyi7PZ.js";

3import net from "node:net";

4import { execFile, spawn } from "node:child_process"

dist/prebuilds/keytar/prebuilds/win32-arm64/keytar.nodeView file

•path = [redacted]-arm64/keytar.node kind = native_binary sizeBytes = 159232 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/prebuilds/keytar/prebuilds/win32-arm64/keytar.nodeView on unpkg

dist/webui/fonts/Geist-Variable.woff2View file

•path = dist/webui/fonts/Geist-Variable.woff2 kind = high_entropy_blob sizeBytes = 69652 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/webui/fonts/Geist-Variable.woff2View on unpkg