registry / pushy-server / 2026.7.1-ef966775

pushy-server@2026.7.1-ef966775

⚠ Under review

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 15 file(s), 4.30 MB of source, external domains: accounts.google.com, api.nodemailer.com, cdn.jsdelivr.net, cresc.dev, ely.sia, ethereal.email, github.com, jimmy.warting.se, jira.mariadb.org, json-schema.org, mail.google.com, mths.be, nodemailer.com, openapi.alipay.com, pris.ly, pushy.reactnative.cn, registry.npmjs.org, s.io, sts.aliyuncs.com, www.apple.com, www.prisma.io, www.w3.org

Oversized source lightweight scan

lib/chunk-xm019qxn.js4.61 MB file, sampled 256 KB

HighEntropyStringsMinified

Source & flagged code

12 flagged

lib/chunk-4mkhmaee.jsView file

20`).concat(`\r L21: `)}function _W($,Z){let X=-1;for(let Q=0;Q<$.length;Q+=2){if($[Q]!==Z)continue;if(X===-1){X=Q;continue}let J=$[X+1];if(Z===fX&&J){let Y=T8($[Q+1],J);if(Y)$[X+1]=Y}$.splice(Q,2),Q-=... L22: `).some((X)=>X.indexOf("(https.js:")!==-1||X.indexOf("node:https:")!==-1)}createSocket($,Z,X){let Q={...Z,secureEndpoint:this.isSecureEndpoint(Z)};Promise.resolve().then(()=>this.c...

Critical

Protestware

Package source matches protestware-related patterns.

lib/chunk-4mkhmaee.jsView on unpkg · L20

7patternName = generic_password severity = medium line = 7 matchedText = `),typeo...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunk-4mkhmaee.jsView on unpkg · L7

lib/pm2Bootstrap.jsView file

Lines 1-22javascript

1#!/usr/bin/env bun

2// @bun

3import{spawnSync as k}from"child_process";import{accessSync as j,constants as M,existsSync as l,readdirSync as N,readFileSync as _,writeFileSync as h}from"fs";import m from"os";import s from"path";var y=["ecosystem.config.cjs","ecosystem.config.js","ecosystem.config.mjs"],x=["/usr/local/sbin","/usr/local/bin"

High

Child Process

Package source references child process execution.

lib/pm2Bootstrap.jsView on unpkg · L2

5Options:

6 --env-file <file> Env file passed to bun, for example .env.ext

7 --config <file> PM2 ecosystem config path

8 --app-name <name> PM2 app name, defaults to package name

9 --script <file> Server script path, defaults to this package lib/index.js

10 --pm2 <file> PM2 executable path

11 --cwd <dir> Working directory, defaults to current directory

12 --no-start Generate or resolve config without calling PM2

13 --no-save Do not run pm2 save after startOrReload

14 --print Print resolved config path and command`)}function g(n){try{return j(n,M.X_OK),!0}catch{return!1}}function E(n){return n.find((e)=>e&&g(e))}function v(n,e=process.env.PATH){if(!e)return;for(let t of e.split(s.delimiter)){if(!t)continue;let r=s.join(t,n);if(g(r))return r}return}function w(n){return n.includes("/run/user/")||n.includes("fnm_multishells")}function $(n,e=process.env.PATH){if(!e)return;for(let t of e.split(s.delimiter)){if(!t||w(t))continue;let r=s.join(t,n);if(g(r))return r}return}function b({binary:n,root:e}){if(!l(e))return;return N(e,{withFileTypes:!0}).fil ...

16module.exports = {

17 apps: [

18 {

19 name: ${u(n)},

20 cwd: ${u(t)},

21 script: ${u(o)},

22 interpreter: ${u(e)},

Long lines were clipped for display.

lib/chunk-0fr3nkvp.jsView file

24L25: `);return L.split(",")}switch(H){case"hoist-pattern":case"public-hoist-pattern":return A(T)}return T}Zk.exports=Uk});var wk=F((zk)=>{var Xk=g("os"),KA=g("path"),Fk=Xk.tmpdir(),d2=p... L26: `,aabOpenApksFailed:"Failed to open generated .apks file",aabReadUniversalApkFailed:"Failed to read universal.apk",aabUniversalApkNotFound:"universal.apk not found in generated .ap...

High

Shell

Package source references shell execution.

lib/chunk-0fr3nkvp.jsView on unpkg · L24

11`,kD=(H,T)=>{let A=[],L="";if(typeof T==="string")T={section:T,whitespace:!1};else T=T||Object.create(null),T.whitespace=T.whitespace===!0;let _=T.whitespace?" = ":"=";for(let E of... L12: `;else if(I&&typeof I==="object")A.push(E);else L+=xL(E)+_+xL(I)+SD}if(T.section&&L.length)L="["+xL(T.section)+"]"+SD+L;for(let E of A){let I=K0(E).join("\\."),C=(T.section?T.secti... L13: `:` ... L15: `,_)}while(L!==-1);return E+=H.substr(_),E};LS.exports={stringReplaceAll:ox,stringEncaseCRLFWithFirstIndex:tx}});var RS=F((Cw,BS)=>{var ex=/(?:\\(u(?:[a-f\d]{4}|\{[a-f\d]{1,6}\})|x... L16: `],["r","\r"],["t","\t"],["b","\b"],["f","\f"],["v","\v"],["0","\x00"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function DS(H){let T=H[0]==="u",A=H[1]==="{";if(T&&!A&&H.length===5||... L17: `);if(E!==-1)T=DJ(T,_,L,E);return L+T+_},OD,KS=(H,...T)=>{let[A]=T;if(!rE(A)||!rE(A.raw))return T.join(" ");let L=T.slice(1),_=[A.raw[0]];for(let E=1;E<A.length;E++)_.push(String(L... L18: GFS4: `),console.error(H)};if(!WH[nH]){if(yD=global[nH]||[],tS(WH,yD),WH.close=function(H){function T(A,L){return H.call(WH,A,function(_){if(!_)oS();if(typeof L==="function")L.appl... ... L24: L25: `);return L.split(",")}switch(H){case"

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/chunk-0fr3nkvp.jsView on unpkg · L11

lib/index.jsView file

274`),console.warn(eY.valibot);break;case"effect":if(n4.effect)break;n4.effect=!0,console.warn("[@elysiajs/openapi] Effect Schema doesn't provide JSON Schema method on the schema"),co... L275: `),console.warn(eY.effect);break}if(w==="arktype")return E4($?.toJsonSchema?.());return E4($.toJSONSchema?.()??$?.toJsonSchema?.())}catch(G){console.warn(G)}},E4=($)=>{if(!$||typeo... L276:

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/index.jsView on unpkg · L274

3causes have become circular...`;let w=Q9($);if(w)return q.add($),Y+` L4: caused by: `+fW(w,q);else return Y},qm=($)=>fW($,new Set),kW=($,q,Y)=>{if(!d5($))return"";let w=Y?"":$.message||"";if(q.has($))return w+": ...";let G=Q9($);if(G){q.add($);let X=typ... L5: ${I}`,n=`, ... L21: ${_}${o} L22: ${I}`;return T.pop(),`{${o}}`}case"number":return isFinite(H)?String(H):q?q(H):"null";case"boolean":return H===!0?"true":"false";case"undefined":return;case"bigint":if(w)return Str... L23: `:` ... L25: Supported algorithms are: L26: "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,s5="secret must be a string or buffer",q5="key must be a str... L27: * mime-types ... L42: `);if(J.push(f,I,H),typeof I.size==="number")K+=f.byteLength+I.size+H.byteLength;else T=!0}let c=kG.encode(`--${j}--\r L43: `);if(J.push(c),K+=c.byteLength,T)K=null;X=$,G=async function*(){for(let _ of J)if(_.stream)yield*_.stream();else yield _},Z=`multipart/form-data; boundary=${j}`}else if(U8.is.Blob... L44: `).map((w)=>w.trim()).filter((w)=>w!==""&&!w.startsWith("#"));while(Y.length>0)q.push(xF(Y));if(q.length===0)throw Error("PEM: no block");return

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/index.jsView on unpkg · L3

lib/chunk-4qsg2bx7.jsView file

169*/var Hw1=/["'&<>]/;OT.exports=Nw1;function Nw1(X){var J=""+X,Z=Hw1.exec(J);if(!Z)return J;var Y,W="",$=0,Q=0;for($=Z.index;$<J.length;$++){switch(J.charCodeAt($)){case 34:Y="&quot... L170: * is-extendable <https://github.com/jonschlinkert/is-extendable> L171: * ... L176: `+J.prev+J.base;return Z+T2.call(X,","+Z)+` L177: `+J.prev}function lQ(X,J){var Z=tD(X),Y=[];if(Z){Y.length=X.length;for(var W=0;W<X.length;W++)Y[W]=O9(X,W)?J(X[W],X):""}var $=typeof pD==="function"?pD(X):[],Q;if(sX){Q={};for(var ... L178: * statuses

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunk-4qsg2bx7.jsView on unpkg · L169

10\v\f\r\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u2... L11: \v\f\r\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\xA5]^_\`abcdefghijklmnopqrstuvwxyz{|}\u20... L12: | 0 1 2 3 4 5 6 7 8 9 a b c d e f |

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/chunk-4qsg2bx7.jsView on unpkg · L10

lib/node-hdiffpatch-q8ah3hfz.nodeView file

•path = lib/node-hdiffpatch-q8ah3hfz.node kind = native_binary sizeBytes = 463096 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/node-hdiffpatch-q8ah3hfz.nodeView on unpkg

lib/chunk-xm019qxn.jsView file

•path = lib/chunk-xm019qxn.js kind = oversized_source_file sizeBytes = 4837698 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunk-xm019qxn.jsView on unpkg

Source & flagged code

12 flagged · loading source

lib/chunk-4mkhmaee.jsView file

Critical

Protestware

Package source matches protestware-related patterns.

lib/chunk-4mkhmaee.jsView on unpkg · L20

7patternName = generic_password severity = medium line = 7 matchedText = `),typeo...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunk-4mkhmaee.jsView on unpkg · L7

lib/pm2Bootstrap.jsView file

2// @bun L3: import{spawnSync as k}from"child_process";import{accessSync as j,constants as M,existsSync as l,readdirSync as N,readFileSync as _,writeFileSync as h}from"fs";import m from"os";imp... L4:

High

Child Process

Package source references child process execution.

lib/pm2Bootstrap.jsView on unpkg · L2

lib/chunk-0fr3nkvp.jsView file

High

Shell

Package source references shell execution.

lib/chunk-0fr3nkvp.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/chunk-0fr3nkvp.jsView on unpkg · L11

1Cross-file remote execution chain: lib/chunk-0fr3nkvp.js spawns lib/chunk-4qsg2bx7.js; helper contains network access plus dynamic code execution. L1: // @bun L2: import{I as _N,K as Xc,L as Fc,M as zc,O as wc,P as uR,z as LN}from"./chunk-ky15w44h.js";import{Ea as Pc,Fa as Yc,Ia as fR,X as Y9,aa as cc,ba as $c,ua as vH}from"./chunk-4qsg2bx7.... L3: loaded from: `+H+` L4: `);function C(R){var S=g9(kA.join(R,"prebuilds")).map(H8),k=S.filter(T8(v9,y9)).sort(A8)[0];if(!k)return;var D=kA.join(R,"prebuilds",k.name),B=g9(D).map(L8),G=B.filter(_8(f9,iR)),h... L5: ... L11: `,kD=(H,T)=>{let A=[],L="";if(typeof T==="string")T={section:T,whitespace:!1};else T=T||Object.create(null),T.whitespace=T.whitespace===!0;let _=T.whitespace?" = ":"=";for(let E of... L12: `;else if(I&&typeof I==="object")A.push(E);else L+=xL(E)+_+xL(I)+SD}if(T.section&&L.length)L="["+xL(T.section)+"]"+SD+L;for(let E of A){let I=K0(E).join("\\."),C=(T.section?T.secti... L13: `:` ... L15: `,_)}while(L!==-1);return E+=H.substr(_),E};LS.exports={stringReplaceAll:ox,stringEncaseCRLFWithFirstIndex:tx}});var RS=F((Cw,BS)=>{var ex=/(?:\\(u(?:[a-f\d]{4}|\{[a-f\d]{1,6}\})|x... L16: `],["r","\r"],["t","\t"],["b","\b"],["f","\f"],…

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/chunk-0fr3nkvp.jsView on unpkg · L1

lib/index.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/index.jsView on unpkg · L274

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/index.jsView on unpkg · L3

lib/chunk-4qsg2bx7.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunk-4qsg2bx7.jsView on unpkg · L169

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/chunk-4qsg2bx7.jsView on unpkg · L10

lib/node-hdiffpatch-q8ah3hfz.nodeView file

•path = lib/node-hdiffpatch-q8ah3hfz.node kind = native_binary sizeBytes = 463096 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/node-hdiffpatch-q8ah3hfz.nodeView on unpkg

lib/chunk-xm019qxn.jsView file

•path = lib/chunk-xm019qxn.js kind = oversized_source_file sizeBytes = 4837698 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunk-xm019qxn.jsView on unpkg

Findings

1 Critical7 High6 Medium6 Low

CriticalProtestwarelib/chunk-4mkhmaee.js

HighChild Processlib/pm2Bootstrap.js

HighShelllib/chunk-0fr3nkvp.js

HighSame File Env Network Executionlib/chunk-4qsg2bx7.js

HighCommand Output Exfiltrationlib/chunk-0fr3nkvp.js

HighCross File Remote Execution Contextlib/chunk-0fr3nkvp.js

HighObfuscated

HighOversized Source Filelib/chunk-xm019qxn.js

MediumSecret Patternlib/chunk-4mkhmaee.js

MediumDynamic Requirelib/chunk-4qsg2bx7.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarylib/node-hdiffpatch-q8ah3hfz.node

MediumStructural Risk Force Deep Review

LowEvallib/index.js

LowWeak Cryptolib/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

12 flagged

lib/chunk-4mkhmaee.jsView file

Critical

Protestware

Package source matches protestware-related patterns.

lib/chunk-4mkhmaee.jsView on unpkg · L20

7patternName = generic_password severity = medium line = 7 matchedText = `),typeo...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunk-4mkhmaee.jsView on unpkg · L7

lib/pm2Bootstrap.jsView file

Lines 1-22javascript

1#!/usr/bin/env bun

2// @bun

High

Child Process

Package source references child process execution.

lib/pm2Bootstrap.jsView on unpkg · L2

5Options:

6 --env-file <file> Env file passed to bun, for example .env.ext

7 --config <file> PM2 ecosystem config path

8 --app-name <name> PM2 app name, defaults to package name

9 --script <file> Server script path, defaults to this package lib/index.js

10 --pm2 <file> PM2 executable path

11 --cwd <dir> Working directory, defaults to current directory

12 --no-start Generate or resolve config without calling PM2

13 --no-save Do not run pm2 save after startOrReload

16module.exports = {

17 apps: [

18 {

19 name: ${u(n)},

20 cwd: ${u(t)},

21 script: ${u(o)},

22 interpreter: ${u(e)},

Long lines were clipped for display.

lib/chunk-0fr3nkvp.jsView file

High

Shell

Package source references shell execution.

lib/chunk-0fr3nkvp.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/chunk-0fr3nkvp.jsView on unpkg · L11

lib/index.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/index.jsView on unpkg · L274

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/index.jsView on unpkg · L3

lib/chunk-4qsg2bx7.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunk-4qsg2bx7.jsView on unpkg · L169

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/chunk-4qsg2bx7.jsView on unpkg · L10

lib/node-hdiffpatch-q8ah3hfz.nodeView file

•path = lib/node-hdiffpatch-q8ah3hfz.node kind = native_binary sizeBytes = 463096 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/node-hdiffpatch-q8ah3hfz.nodeView on unpkg

lib/chunk-xm019qxn.jsView file

•path = lib/chunk-xm019qxn.js kind = oversized_source_file sizeBytes = 4837698 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunk-xm019qxn.jsView on unpkg