prismic@1.17.0
⚠ Under reviewPrismic's official command line tool
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•name = prismic; similarTo = prisma
Medium
Typosquat Name
Package name is suspiciously similar to a popular package name.
package.jsonView on unpkgdist/auth-BQ-T06tR.mjsView file
1import{A as e,B as t,E as n,L as r,N as i,P as a,R as o,T as s,b as c,c as l,g as u,h as d,j as f,o as p,s as m,y as h,z as g}from"./request-DEP7ruRD.mjs";import{readFile as _,rm a...
High
Child Process
Package source references child process execution.
dist/auth-BQ-T06tR.mjsView on unpkg · L11import{A as e,B as t,E as n,L as r,N as i,P as a,R as o,T as s,b as c,c as l,g as u,h as d,j as f,o as p,s as m,y as h,z as g}from"./request-DEP7ruRD.mjs";import{readFile as _,rm a...
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
4 High4 Medium6 Low
HighChild Processdist/auth-BQ-T06tR.mjs
HighSame File Env Network Executiondist/index.mjs
HighSandbox Evasion Gated Capabilitydist/auth-BQ-T06tR.mjs
HighPrevious Version Dangerous Deltadist/index.mjs
MediumTyposquat Namepackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/core-C2WfsoNg.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to prismic@1.17.0.
See all versions of prismic for other recorded verdicts.
- Review the evidence and your use of prismic@1.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.