Static Scan Results
scanned 1d ago · by rust-scannerStatic analysis flagged 37 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
29 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgapp/.next/server/chunks/_d1e03206._.jsView file
44patternName = private_key_rsa
severity = critical
line = 44
matchedText = `),c.pus...(r)}
Critical
Critical Secret
Package contains a critical-looking secret pattern.
app/.next/server/chunks/_d1e03206._.jsView on unpkg · L4444patternName = private_key_rsa
severity = critical
line = 44
matchedText = `),c.pus...(r)}
Critical
Secret Pattern
RSA private key in app/.next/server/chunks/_d1e03206._.js
app/.next/server/chunks/_d1e03206._.jsView on unpkg · L44app/dbsetup.jsView file
2L3: import { spawn } from 'node:child_process'
L4:
High
12function exec(command) {
L13: const child = spawn(command, { shell: true, stdio: 'inherit', env })
L14: return new Promise((resolve, reject) => {
High
6L7: await exec('npx next build --experimental-build-mode generate')
L8:
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
app/dbsetup.jsView on unpkg · L6app/bin/routiform.mjsView file
109try {
L110: const { run } = await import("./cli/dispatch.mjs");
L111: await run(args);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
app/bin/routiform.mjsView on unpkg · L109app/open-sse/services/qoderCli.tsView file
1import { spawn as _spawn } from "child_process";
L2: import crypto from "crypto";
...
L14: // The two tier IDs below are the universally-available smart-routing wrappers
L15: // listed at https://docs.qoder.com/user-guide/chat/model-tier-selector.
L16: // Frontier models (qmodel/dmodel/...) are intentionally NOT hard-coded — the
...
L38: code: number | null;
L39: stdout: string;
L40: stderr: string;
...
L59: export function getQoderCliCommand(): string {
L60: const explicit = String(process.env.CLI_QODER_BIN || "").trim();
L61: return explicit || "qodercli";
...
L69: const home = String(process.env.HOME || "").trim();
Low
Weak Crypto
Package source references weak cryptographic algorithms.
app/open-sse/services/qoderCli.tsView on unpkg · L1app/scripts/run-ecosystem-tests.mjsView file
2L3: import { spawn } from "node:child_process";
L4: import { setTimeout as delay } from "node:timers/promises";
...
L6:
L7: const port = process.env.DASHBOARD_PORT || process.env.PORT || "20128";
L8: const baseUrl = process.env.ROUTIFORM_BASE_URL || `http://localhost:${port}`;
L9: const healthUrl = `${baseUrl}/api/monitoring/health`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
app/scripts/run-ecosystem-tests.mjsView on unpkg · L2app/scripts/postinstall.mjsView file
14*
L15: * Fixes: https://github.com/linhnguyen-gt/Routiform/issues/129
L16: * Fixes: https://github.com/linhnguyen-gt/Routiform/issues/321
...
L26: const __filename = fileURLToPath(import.meta.url);
L27: const __dirname = dirname(__filename);
L28: const ROOT = join(__dirname, "..");
...
L52: const platformMatch =
L53: process.platform === PUBLISHED_BUILD_PLATFORM && process.arch === PUBLISHED_BUILD_ARCH;
L54:
...
L88: try {
L89: const { execSync } = await import("node:child_process");
L90: // better-sqlite3 bundles @mapbox/node-pre-gyp — use it directly
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
app/scripts/postinstall.mjsView on unpkg · L14app/src/lib/network/safeOutboundFetch.tsView file
1import { isIP } from "node:net";
L2: import { lookup } from "node:dns/promises";
L3:
...
L18: allowLoopback?: boolean;
L19: allowPrivateAddress?: boolean;
L20: }
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
app/src/lib/network/safeOutboundFetch.tsView on unpkg · L1app/tests/security/test-cloud-sync-and-call.shView file
•path = app/tests/security/test-cloud-sync-and-call.sh
kind = payload_in_excluded_dir
sizeBytes = 3567
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
app/tests/security/test-cloud-sync-and-call.shView on unpkg•path = app/tests/security/test-cloud-sync-and-call.sh
kind = build_helper
sizeBytes = 3567
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
app/tests/security/test-cloud-sync-and-call.shView on unpkgapp/.next/static/media/1bffadaabf893a1e-s.7cd81963.woff2View file
•path = app/.[redacted]-s.7cd81963.woff2
kind = high_entropy_blob
sizeBytes = 85272
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
app/.next/static/media/1bffadaabf893a1e-s.7cd81963.woff2View on unpkgapp/.next/server/chunks/ssr/_64b9964f._.jsView file
•path = app/.next/server/chunks/ssr/_64b9964f._.js
kind = oversized_source_file
sizeBytes = 3270371
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
app/.next/server/chunks/ssr/_64b9964f._.jsView on unpkgapp/tests/unit/login-bootstrap-route.test.mjsView file
77patternName = generic_password
severity = medium
line = 77
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in app/tests/unit/login-bootstrap-route.test.mjs
app/tests/unit/login-bootstrap-route.test.mjsView on unpkg · L77140patternName = generic_password
severity = medium
line = 140
matchedText = const pa...et";
Medium
Secret Pattern
Hardcoded password in app/tests/unit/login-bootstrap-route.test.mjs
app/tests/unit/login-bootstrap-route.test.mjsView on unpkg · L140167patternName = generic_password
severity = medium
line = 167
matchedText = body: JS... }),
Medium
Secret Pattern
Hardcoded password in app/tests/unit/login-bootstrap-route.test.mjs
app/tests/unit/login-bootstrap-route.test.mjsView on unpkg · L167app/tests/unit/api-auth.test.mjsView file
152patternName = generic_password
severity = medium
line = 152
matchedText = await lo... });
Medium
Secret Pattern
Hardcoded password in app/tests/unit/api-auth.test.mjs
app/tests/unit/api-auth.test.mjsView on unpkg · L152app/tests/unit/mitm-core.test.mjsView file
108patternName = private_key_rsa
severity = critical
line = 108
matchedText = assert.o...M");
Critical
Secret Pattern
RSA private key in app/tests/unit/mitm-core.test.mjs
app/tests/unit/mitm-core.test.mjsView on unpkg · L108app/tests/unit/require-management-auth.test.mjsView file
34patternName = generic_password
severity = medium
line = 34
matchedText = await up... });
Medium
Secret Pattern
Hardcoded password in app/tests/unit/require-management-auth.test.mjs
app/tests/unit/require-management-auth.test.mjsView on unpkg · L34app/tests/unit/provider-validation-branches.test.mjsView file
433patternName = private_key_rsa
severity = critical
line = 433
matchedText = private_...\n",
Critical
Secret Pattern
RSA private key in app/tests/unit/provider-validation-branches.test.mjs
app/tests/unit/provider-validation-branches.test.mjsView on unpkg · L433app/tests/unit/mcp-management-routes-auth.test.mjsView file
44patternName = generic_password
severity = medium
line = 44
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in app/tests/unit/mcp-management-routes-auth.test.mjs
app/tests/unit/mcp-management-routes-auth.test.mjsView on unpkg · L44app/.next/server/chunks/[root-of-the-server]__a1924923._.jsView file
3patternName = generic_password
severity = medium
line = 3
matchedText = `),s.std...)}];
Medium
Secret Pattern
Hardcoded password in app/.next/server/chunks/[root-of-the-server]__a1924923._.js
app/.next/server/chunks/[root-of-the-server]__a1924923._.jsView on unpkg · L3app/.next/server/chunks/_5664c74a._.jsView file
44patternName = private_key_rsa
severity = critical
line = 44
matchedText = `),c.pus...(r)}
Critical
Secret Pattern
RSA private key in app/.next/server/chunks/_5664c74a._.js
app/.next/server/chunks/_5664c74a._.jsView on unpkg · L44app/.next/server/chunks/_593a35c0._.jsView file
201patternName = private_key_rsa
severity = critical
line = 201
matchedText = `),c.pus...(r)}
Critical
Secret Pattern
RSA private key in app/.next/server/chunks/_593a35c0._.js
app/.next/server/chunks/_593a35c0._.jsView on unpkg · L201app/.next/server/chunks/_ba688be4._.jsView file
199patternName = private_key_rsa
severity = critical
line = 199
matchedText = `),c.pus...nt:`
Critical
Secret Pattern
RSA private key in app/.next/server/chunks/_ba688be4._.js
app/.next/server/chunks/_ba688be4._.jsView on unpkg · L199app/src/mitm/manager.tsView file
326patternName = generic_password
severity = medium
line = 326
matchedText = console....ge);
Medium
Secret Pattern
Hardcoded password in app/src/mitm/manager.ts
app/src/mitm/manager.tsView on unpkg · L326Findings
7 Critical10 High14 Medium6 Low
CriticalCritical Secretapp/.next/server/chunks/_d1e03206._.js
CriticalSecret Patternapp/tests/unit/mitm-core.test.mjs
CriticalSecret Patternapp/tests/unit/provider-validation-branches.test.mjs
CriticalSecret Patternapp/.next/server/chunks/_d1e03206._.js
CriticalSecret Patternapp/.next/server/chunks/_5664c74a._.js
CriticalSecret Patternapp/.next/server/chunks/_593a35c0._.js
CriticalSecret Patternapp/.next/server/chunks/_ba688be4._.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processapp/dbsetup.js
HighShellapp/dbsetup.js
HighSame File Env Network Executionapp/scripts/run-ecosystem-tests.mjs
HighSandbox Evasion Gated Capabilityapp/scripts/postinstall.mjs
HighCloud Metadata Accessapp/src/lib/network/safeOutboundFetch.ts
HighRuntime Package Installapp/dbsetup.js
HighShips High Entropy Blobapp/.next/static/media/1bffadaabf893a1e-s.7cd81963.woff2
HighPayload In Excluded Dirapp/tests/security/test-cloud-sync-and-call.sh
HighOversized Source Fileapp/.next/server/chunks/ssr/_64b9964f._.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireapp/bin/routiform.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperapp/tests/security/test-cloud-sync-and-call.sh
MediumStructural Risk Force Deep Review
MediumSecret Patternapp/tests/unit/login-bootstrap-route.test.mjs
MediumSecret Patternapp/tests/unit/login-bootstrap-route.test.mjs
MediumSecret Patternapp/tests/unit/login-bootstrap-route.test.mjs
MediumSecret Patternapp/tests/unit/api-auth.test.mjs
MediumSecret Patternapp/tests/unit/require-management-auth.test.mjs
MediumSecret Patternapp/tests/unit/mcp-management-routes-auth.test.mjs
MediumSecret Patternapp/.next/server/chunks/[root-of-the-server]__a1924923._.js
MediumSecret Patternapp/src/mitm/manager.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptoapp/open-sse/services/qoderCli.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings