registry / reddit-sonar / 1.0.0

reddit-sonar@1.0.0

AI-powered Reddit lead generation tool — search, score, summarize, and engage with leads using Playwright + OpenRouter or DeepSeek

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequire

Supply chain

MinifiedObfuscatedTrivialUrlStrings

Manifest

NoLicense

scanned 2 file(s), 615 KB of source, external domains: platform.deepseek.com, wholesaas.com

Source & flagged code

2 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2/**

3 * CLI entry point for the npm bin. Thin launcher that hands off to the bundled,

4 * obfuscated artifact in dist/cli.js. No tsx — the published package never

5 * compiles on the user's machine.

6 *

7 * Resolves dist/cli.js relative to this file via import.meta.url, so it works

8 * whether invoked directly, via npx, or through a global npm symlink.

9 *

10 * npx reddit-sonar # normal launch

11 * npx reddit-sonar --setup # force the setup wizard

12 */

13import { resolve, dirname } from "path";

14import { pathToFileURL } from "url";

15import { fileURLToPath } from "url";

17const __dirname = dirname(fileURLToPath(import.meta.url));

18const entry = resolve(__dirname, "..", "dist", "cli.js");

20await import(pathToFileURL(entry).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L19

dist/cli.jsView file

1#!/usr/bin/env node L2: const _0x69f6c4=_0x2f23;(function(_0x2dc11b,_0x569fa4){const _0xbb0acf=_0x2f23,_0x1fac63=_0x2dc11b();while(!![]){try{const _0x1bbad4=parseInt(_0xbb0acf(0x5fd))/0x1*(parseInt(_0xbb0...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

bin/cli.jsView file

19L20: await import(pathToFileURL(entry).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L19

dist/cli.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

Findings

2 High2 Medium3 Low

HighObfuscated Payload Loaderdist/cli.js

HighObfuscated

MediumDynamic Requirebin/cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2/**

3 * CLI entry point for the npm bin. Thin launcher that hands off to the bundled,

4 * obfuscated artifact in dist/cli.js. No tsx — the published package never

5 * compiles on the user's machine.

6 *

7 * Resolves dist/cli.js relative to this file via import.meta.url, so it works

8 * whether invoked directly, via npx, or through a global npm symlink.

9 *

10 * npx reddit-sonar # normal launch

11 * npx reddit-sonar --setup # force the setup wizard

12 */

13import { resolve, dirname } from "path";

14import { pathToFileURL } from "url";

15import { fileURLToPath } from "url";

17const __dirname = dirname(fileURLToPath(import.meta.url));

18const entry = resolve(__dirname, "..", "dist", "cli.js");

20await import(pathToFileURL(entry).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L19

dist/cli.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1