Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 25 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
17 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = prisma generate --schema=prisma/schema.sqlite.prisma
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = prisma generate --schema=prisma/schema.sqlite.prisma
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgprisma/notes/1.4 Control Flow/conditional-statements.tsView file
114patternName = generic_password
severity = medium
line = 114
matchedText = password...123"
Medium
Secret Pattern
Package contains a possible secret pattern.
prisma/notes/1.4 Control Flow/conditional-statements.tsView on unpkg · L114bin/cli.jsView file
29const net = require("net");
L30: const { execSync, spawn } = require("child_process");
L31:
High
386// Set environment
L387: process.env.DATABASE_URL = `file:${DB_PATH}`;
L388: process.env.PORT = String(port);
...
L396:
L397: console.log(`\n🚀 Starting PyMentor on http://localhost:${port}...\n`);
L398:
L399: const server = spawn("node", [SERVER_PATH], {
L400: cwd: SERVER_DIR,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L38628Cross-file remote execution chain: bin/cli.js spawns prisma/seed.js; helper contains network access plus dynamic code execution.
L28: const fs = require("fs");
L29: const net = require("net");
L30: const { execSync, spawn } = require("child_process");
L31:
...
L35:
L36: const DATA_DIR = path.join(os.homedir(), ".pymentor");
L37: const DB_PATH = path.join(DATA_DIR, "pymentor.db");
...
L90: const value = trimmed.slice(eqIndex + 1).trim();
L91: process.env[key] = value;
L92: }
...
L99: try {
L100: return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf-8"));
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/cli.jsView on unpkg · L28252if (fs.existsSync(originalSeedPath)) {
L253: execSync(`npx tsx "${originalSeedPath}"`, {
L254: cwd: ROOT_DIR,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/cli.jsView on unpkg · L252prisma/notes/2.5 Error Handling/exercises.tsView file
67starterCode: "# Write safe_process with multi-exception handling\n",
L68: solutionCode: "def safe_process(data):\n try:\n raw = data['value']\n except KeyError:\n print('Missing key: value')\n return\n try:\n num = in...
L69: testCases: [
Low
Eval
Package source references a known benign dynamic code generation pattern.
prisma/notes/2.5 Error Handling/exercises.tsView on unpkg · L67prisma/notes/1.5 Loops/while-loops.tsView file
117patternName = generic_password
severity = medium
line = 117
matchedText = correct_...123"
Medium
Secret Pattern
Hardcoded password in prisma/notes/1.5 Loops/while-loops.ts
prisma/notes/1.5 Loops/while-loops.tsView on unpkg · L117prisma/notes/1.3 Operators/comparison-operators.tsView file
57patternName = generic_password
severity = medium
line = 57
matchedText = user_pas...123"
Medium
Secret Pattern
Hardcoded password in prisma/notes/1.3 Operators/comparison-operators.ts
prisma/notes/1.3 Operators/comparison-operators.tsView on unpkg · L5758patternName = generic_password
severity = medium
line = 58
matchedText = entered_...ass"
Medium
Secret Pattern
Hardcoded password in prisma/notes/1.3 Operators/comparison-operators.ts
prisma/notes/1.3 Operators/comparison-operators.tsView on unpkg · L58221patternName = generic_password
severity = medium
line = 221
matchedText = correct_...123"
Medium
Secret Pattern
Hardcoded password in prisma/notes/1.3 Operators/comparison-operators.ts
prisma/notes/1.3 Operators/comparison-operators.tsView on unpkg · L221prisma/seed.jsView file
2613patternName = generic_password
severity = medium
line = 2613
matchedText = user_pas...123"
Medium
2614patternName = generic_password
severity = medium
line = 2614
matchedText = entered_...ass"
Medium
2777patternName = generic_password
severity = medium
line = 2777
matchedText = correct_...123"
Medium
4527patternName = generic_password
severity = medium
line = 4527
matchedText = password...123"
Medium
5536patternName = generic_password
severity = medium
line = 5536
matchedText = correct_...123"
Medium
Findings
6 High14 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCross File Remote Execution Contextbin/cli.js
HighRuntime Package Installbin/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patternprisma/notes/1.4 Control Flow/conditional-statements.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternprisma/notes/1.5 Loops/while-loops.ts
MediumSecret Patternprisma/notes/1.3 Operators/comparison-operators.ts
MediumSecret Patternprisma/notes/1.3 Operators/comparison-operators.ts
MediumSecret Patternprisma/notes/1.3 Operators/comparison-operators.ts
MediumSecret Patternprisma/seed.js
MediumSecret Patternprisma/seed.js
MediumSecret Patternprisma/seed.js
MediumSecret Patternprisma/seed.js
MediumSecret Patternprisma/seed.js
LowScripts Present
LowEvalprisma/notes/2.5 Error Handling/exercises.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings