registry / portomatic / 0.2.1
portomatic@0.2.1
⚠ Under reviewSlack for testing bots, with the real Slack client.
Static Scan Results
scanned 14d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
products/slack/client/dist/assets/bv1-13/gantry-v2-async-quip-collab-webapp.1d2e509b82980c2c.min.js5.39 MB file, sampled 256 KB
HighEntropyStringsMinifiedUrlStrings127.0.0.1
Source & flagged code
9 flaggedproducts/slack/dist/src/cli/run.jsView file
1var T=Object.defineProperty;var s=(r,t)=>T(r,"name",{value:t,configurable:!0});import{spawn as u}from"node:child_process";import{runtimeEnvironment as w}from"../testing/runtime.js"...
High
Child Process
Package source references child process execution.
products/slack/dist/src/cli/run.jsView on unpkg · L1products/slack/client/dist/assets/bv1-13-br/gantry-v2-manifest.7d0b6d66344ea32b.min.jsView file
13255try {
L13256: return this || new Function("return this")();
L13257: } catch (e) {
Low
Eval
Package source references a known benign dynamic code generation pattern.
products/slack/client/dist/assets/bv1-13-br/gantry-v2-manifest.7d0b6d66344ea32b.min.jsView on unpkg · L13255Findings
5 High5 Medium8 Low
HighChild Processproducts/slack/dist/src/cli/run.js
HighSame File Env Network Executionproducts/slack/dist/src/testing/index.js
HighCommand Output Exfiltrationproducts/slack/dist/src/testing/index.js
HighTrigger Reachable Command Output Exfiltrationproducts/slack/dist/src/testing/index.js
HighSemantic Analysis Limitedproducts/slack/client/dist/assets/bv1-13/gantry-v2-async-markdown-it.0c787ab8bb3b40bb.min.js
MediumDynamic Requireproducts/slack/dist/src/main.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Fileproducts/slack/client/dist/assets/bv1-13/gantry-v2-async-quip-collab-webapp.1d2e509b82980c2c.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to portomatic@0.2.1.
See all versions of portomatic for other recorded verdicts.
- Review the evidence and your use of portomatic@0.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.