registry / rsshub / 1.0.0-master.bd24a2f

rsshub@1.0.0-master.bd24a2f

Make RSS Great Again!

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

CopyleftLicense

scanned 3,604 file(s), 10.4 MB of source, external domains: 005.tv, 0x80.pl, 0xxx.ws, 1.1.1.1, 119.29.146.143, 127.0.0.1, 141jav.com, 141ppv.com, 18comic.org, 1x.com, 2048.info, 210.26.0.114, 2yuan.xjtu.edu.cn, 360zy.com, 3g.163.com, 3g.dxy.cn, 4a735ea38f8146198dc205d2e2d1bd28.z3c.jin10.com, 4kup.net, 500px.com.cn, 54youth.nwsuaf.edu.cn, 58.213.82.179, 60s.aa1.cn, 6api.ycwb.com, 7mmtv.sx, 81rc.81.cn, 82.157.138.16, 95.216.22.207, 9oyi4rk426.execute-api.ca-central-1.amazonaws.com, 9to5google.com, 9to5mac.com, 9to5toys.com, a.4cdn.org, a.ajmide.com, aa.nycu.edu.tw, aamacau.com, aao.nuaa.edu.cn, abc.net.au, about.netflix.com, about.voronoiapp.com, abs.twimg.com, ac.qq.com, academia.edu, academic.oup.com, accounts.spotify.com, acg.gamer.com.tw, acg17.com, acm.ecnu.edu.cn, adam-weekly-api-server-prod-ufaummkd5q-de.a.run.app, addons.mozilla.org, adma.ustb.edu.cn

Oversized source lightweight scan

dist-lib/routes-CJerc_Oo.mjs3.94 MB file, sampled 256 KB

ChildProcessHighEntropyStringsUrlStrings81rc.81.cncastbox.fmconsole.cloud.google.comconsole.developers.google.comdocs.rsshub.appdt.yicai.comdy.163.comgithub.comm.weibo.cnminiflux.appmp.weixin.qq.comn.ifun.coolnews-at.zhihu.comphotos.app.goo.glreader.miniflux.apprent.591.com.twrsshub.appscholar.google.comsearch.careerengine.ust1.daumcdn.netweb.devwechat2rss.xlab.appweibo.comwww.economist.com

dist-lib/routes-eTaCp8-N.mjs3.91 MB file, sampled 256 KB

ChildProcessHighEntropyStringsUrlStrings81rc.81.cncastbox.fmconsole.cloud.google.comconsole.developers.google.comdocs.rsshub.appdt.yicai.comdy.163.comgithub.comminiflux.appn.ifun.coolnews-at.zhihu.comphotos.app.goo.glreader.miniflux.apprent.591.com.twrsshub.appscholar.google.comt1.daumcdn.netwww.economist.comwww.google.comwww.jl1mall.comwww.jll.comwww.joneslanglasalle.com.cnwww.xinpianchang.comwww.yahoo.com

Source & flagged code

12 flagged

dist-lib/latest-CTkD6VYz.mjsView file

Lines 1-30javascript

1import { t as rofetch } from "./ofetch-BeGS7eF7.mjs";

2import { t as config } from "./config-CPz0CKkC.mjs";

3import "./types-DNj6Etbg.mjs";

4import { t as cache_default } from "./cache-AVLkxzHf.mjs";

5import { t as got_default } from "./got-B-0xELuF.mjs";

6import { t as parseArticle } from "./utils-CXUAyV8T.mjs";

7import crypto from "node:crypto";

8import { KJUR, hextob64 } from "jsrsasign";

9//#region lib/routes/caixin/utils-fulltext.ts

10const rsaPrivateKey = "-----BEGIN PRIVATE KEY-----MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCLci8q2u3NGFyFlMUwjCP91PsvGjHdRAq9fmqZLxvue+n+RhzNxnKKYOv35pLgFKWXsGq2TV+5Xrv6xZgNx36IUkqbmrO+eCa8NFmti04wvMfG3DCNdKA7Lue880daNiK3BOhlQlZPykUXt1NftMNS/z+e70W+Vpv1ZxCx5BipqZkdoceM3uin0vUQmqmHqjxi5qKUuov90dXLaMxypCA0TDsIDnX8RPvPtqKff1p2TMW2a0XYe7CPYhRggaQMpmo0TcFutgrM1Vywyr2TPxYR+H/tpuuWRET7tUIQykBYoO1WKfL2dX6cxarjAJfnYnod3sMzppHouyp8Pt7gHVG7AgMBAAECggEAEFshSy6IrADKgWSUyH/3jMNZfwnchW6Ar/9O847CAPQJ2yhQIpa/Qpnhs58Y5S2myqcHrUBgFPcWp3BbyGn43naAh8XahWHEcVjWl/N6BV9vM1UKYN0oGikDR3dljCBDbCIoPBBO3WcFOaXoIp ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist-lib/latest-CTkD6VYz.mjsView on unpkg · L10

Critical

Secret Pattern

RSA private key in dist-lib/latest-CTkD6VYz.mjs

dist-lib/latest-CTkD6VYz.mjsView on unpkg · L10

11async function getFulltext(url) {

12 if (!config.caixin.cookie) return;

13 if (!/\d+\.html/.test(url)) return;

14 const articleID = url.match(/(\d+)\.html/)[1];

15 const nonce = crypto.randomUUID().replaceAll("-", "").toUpperCase();

16 const rawString = `id=${articleID}&uid=${config.caixin.cookie.split(";").find((e) => e.includes("SA_USER_UID"))?.split("=", 2)[1]}&${nonce}=nonce`;

17 const sig = new KJUR.crypto.Signature({ alg: "SHA256withRSA" });

18 sig.init(rsaPrivateKey);

19 sig.updateString(rawString);

20 const sigValueHex = hextob64(sig.sign());

21 const res = await rofetch("https://gateway.caixin.com/api/newauth/checkAuthByIdJsonp", {

22 query: {

23 type: 1,

24 page: url.includes("weekly") ? 0 : 1,

25 rand: Math.random(),

26 id: articleID

27 },

28 headers: {

29 "X-Sign": encodeURIComponent(sigValueHex),

30 "X-Nonce": encodeURIComponent(nonce),

Long lines were clipped for display.

dist-lib/common-config-CBU99BL7.mjsView file

Lines 1-31javascript

1import { t as rofetch } from "./ofetch-BeGS7eF7.mjs";

2import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

3import { t as timezone } from "./timezone-BBvDwS_3.mjs";

4import { load } from "cheerio";

5import

dist-lib/registry-dev-BpPDWdA6.mjsView file

Lines 17-57javascript

17 const files = [];

18 for (const entry of entries) {

19 const fullPath = path.join(targetDirectoryPath, entry.name);

20 if (entry.isDirectory()) {

21 if

dist-lib/feed-CixTT0nM.mjsView file

Lines 2-42javascript

2import { t as config } from "./config-CPz0CKkC.mjs";

3import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

4import { t as cache_default } from "./cache-AVLkxzHf.mjs";

5import { t as ConfigNotFoundError } from "./config-not-found-fQ5mxvDU.mjs";

dist-lib/explore-BVSethCW.mjsView file

Lines 1-30javascript

1import { t as rofetch } from "./ofetch-BeGS7eF7.mjs";

2import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

3import { t as md5 } from "./md5-CpIHIxCO.mjs";

4import crypto from "node:crypto";

5import sanitizeHtml

dist-lib/routes-CJerc_Oo.mjsView file

•path = dist-lib/routes-CJerc_Oo.mjs kind = oversized_source_file sizeBytes = 4135961 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/routes-CJerc_Oo.mjsView on unpkg

dist-lib/charts-CSTCYN42.mjsView file

Lines 72-112javascript

72 title: "Top songs"

73 },

74 TopVideos: {

75 contentKey: "videos",

76 viewKey: "videoViews",

77 title: "Top music videos"

78 },

79 TrendingVideos

dist-lib/utils-DanZbhOi.mjsView file

Lines 19-59javascript

19 "8",

20 "9",

21 "a",

22 "b",

23 "c",

24 "d",

25 "e",

26 "f"

27 ];

dist-lib/prime-community-DcOyGkPd.mjsView file

26patternName = supabase_service_key severity = critical line = 26 matchedText = const TO...ZA";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/prime-community-DcOyGkPd.mjs

dist-lib/prime-community-DcOyGkPd.mjsView on unpkg · L26

dist-lib/utils-BiyO2GgI2.mjsView file

3patternName = generic_password severity = medium line = 3 matchedText = const pw...75";

Medium

Secret Pattern

Hardcoded password in dist-lib/utils-BiyO2GgI2.mjs

dist-lib/utils-BiyO2GgI2.mjsView on unpkg · L3

dist-lib/pickup-CXxOqT65.mjsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const re...K0";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/pickup-CXxOqT65.mjs

dist-lib/pickup-CXxOqT65.mjsView on unpkg · L13

Source & flagged code

12 flagged · loading source

dist-lib/latest-CTkD6VYz.mjsView file

10patternName = private_key_rsa severity = critical line = 10 matchedText = const rs...--";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist-lib/latest-CTkD6VYz.mjsView on unpkg · L10

10patternName = private_key_rsa severity = critical line = 10 matchedText = const rs...--";

Critical

Secret Pattern

RSA private key in dist-lib/latest-CTkD6VYz.mjs

dist-lib/latest-CTkD6VYz.mjsView on unpkg · L10

dist-lib/common-config-CBU99BL7.mjsView file

11const timezone$1 = timezone; L12: if (regex.test(result)) result = eval(result); L13: return result;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-lib/common-config-CBU99BL7.mjsView on unpkg · L11

dist-lib/registry-dev-BpPDWdA6.mjsView file

37const relativeModulePath = filePath.slice(targetDirectoryPath.length); L38: modules[relativeModulePath] = await import(pathToFileURL(filePath).href); L39: }));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-lib/registry-dev-BpPDWdA6.mjsView on unpkg · L37

dist-lib/feed-CixTT0nM.mjsView file

22}; L23: const rootUrl = "https://locals.com"; L24: const route = { ... L203: const response = await rofetch.raw(`${rootUrl}/_server`, { L204: body: createRequestBody(args), L205: headers: {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist-lib/feed-CixTT0nM.mjsView on unpkg · L22

dist-lib/explore-BVSethCW.mjsView file

10const iv = CryptoJS.enc.Utf8.parse("Nmc09JkLzX8765Vb"); L11: const baseUrl = "https://pubscholar.cn"; L12: const sha1 = (str) => crypto.createHash("sha1").update(str).digest("hex"); ... L76: }, L77: body: { L78: page: 1,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist-lib/explore-BVSethCW.mjsView on unpkg · L10

dist-lib/routes-CJerc_Oo.mjsView file

•path = dist-lib/routes-CJerc_Oo.mjs kind = oversized_source_file sizeBytes = 4135961 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/routes-CJerc_Oo.mjsView on unpkg

dist-lib/charts-CSTCYN42.mjsView file

92patternName = google_api_key severity = high line = 92 matchedText = key: "AI..._dM"

High

Secret Pattern

Google API key in dist-lib/charts-CSTCYN42.mjs

dist-lib/charts-CSTCYN42.mjsView on unpkg · L92

dist-lib/utils-DanZbhOi.mjsView file

39patternName = generic_password severity = medium line = 39 matchedText = return m...ce);

Medium

Secret Pattern

Hardcoded password in dist-lib/utils-DanZbhOi.mjs

dist-lib/utils-DanZbhOi.mjsView on unpkg · L39

dist-lib/prime-community-DcOyGkPd.mjsView file

26patternName = supabase_service_key severity = critical line = 26 matchedText = const TO...ZA";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/prime-community-DcOyGkPd.mjs

dist-lib/prime-community-DcOyGkPd.mjsView on unpkg · L26

dist-lib/utils-BiyO2GgI2.mjsView file

3patternName = generic_password severity = medium line = 3 matchedText = const pw...75";

Medium

Secret Pattern

Hardcoded password in dist-lib/utils-BiyO2GgI2.mjs

dist-lib/utils-BiyO2GgI2.mjsView on unpkg · L3

dist-lib/pickup-CXxOqT65.mjsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const re...K0";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/pickup-CXxOqT65.mjs

dist-lib/pickup-CXxOqT65.mjsView on unpkg · L13

Findings

4 Critical2 High7 Medium8 Low

CriticalCritical Secretdist-lib/latest-CTkD6VYz.mjs

CriticalSecret Patterndist-lib/latest-CTkD6VYz.mjs

CriticalSecret Patterndist-lib/prime-community-DcOyGkPd.mjs

CriticalSecret Patterndist-lib/pickup-CXxOqT65.mjs

HighOversized Source Filedist-lib/routes-CJerc_Oo.mjs

HighSecret Patterndist-lib/charts-CSTCYN42.mjs

MediumDynamic Requiredist-lib/registry-dev-BpPDWdA6.mjs

MediumUnsafe Vm Contextdist-lib/feed-CixTT0nM.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist-lib/utils-DanZbhOi.mjs

MediumSecret Patterndist-lib/utils-BiyO2GgI2.mjs

LowScripts Present

LowEvaldist-lib/common-config-CBU99BL7.mjs

LowWeak Cryptodist-lib/explore-BVSethCW.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

12 flagged

dist-lib/latest-CTkD6VYz.mjsView file

Lines 1-30javascript

1import { t as rofetch } from "./ofetch-BeGS7eF7.mjs";

2import { t as config } from "./config-CPz0CKkC.mjs";

3import "./types-DNj6Etbg.mjs";

4import { t as cache_default } from "./cache-AVLkxzHf.mjs";

5import { t as got_default } from "./got-B-0xELuF.mjs";

6import { t as parseArticle } from "./utils-CXUAyV8T.mjs";

7import crypto from "node:crypto";

8import { KJUR, hextob64 } from "jsrsasign";

9//#region lib/routes/caixin/utils-fulltext.ts

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist-lib/latest-CTkD6VYz.mjsView on unpkg · L10

Critical

Secret Pattern

RSA private key in dist-lib/latest-CTkD6VYz.mjs

dist-lib/latest-CTkD6VYz.mjsView on unpkg · L10

11async function getFulltext(url) {

12 if (!config.caixin.cookie) return;

13 if (!/\d+\.html/.test(url)) return;

14 const articleID = url.match(/(\d+)\.html/)[1];

15 const nonce = crypto.randomUUID().replaceAll("-", "").toUpperCase();

16 const rawString = `id=${articleID}&uid=${config.caixin.cookie.split(";").find((e) => e.includes("SA_USER_UID"))?.split("=", 2)[1]}&${nonce}=nonce`;

17 const sig = new KJUR.crypto.Signature({ alg: "SHA256withRSA" });

18 sig.init(rsaPrivateKey);

19 sig.updateString(rawString);

20 const sigValueHex = hextob64(sig.sign());

21 const res = await rofetch("https://gateway.caixin.com/api/newauth/checkAuthByIdJsonp", {

22 query: {

23 type: 1,

24 page: url.includes("weekly") ? 0 : 1,

25 rand: Math.random(),

26 id: articleID

27 },

28 headers: {

29 "X-Sign": encodeURIComponent(sigValueHex),

30 "X-Nonce": encodeURIComponent(nonce),

Long lines were clipped for display.

dist-lib/common-config-CBU99BL7.mjsView file

Lines 1-31javascript

1import { t as rofetch } from "./ofetch-BeGS7eF7.mjs";

2import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

3import { t as timezone } from "./timezone-BBvDwS_3.mjs";

4import { load } from "cheerio";

5import

dist-lib/registry-dev-BpPDWdA6.mjsView file

Lines 17-57javascript

17 const files = [];

18 for (const entry of entries) {

19 const fullPath = path.join(targetDirectoryPath, entry.name);

20 if (entry.isDirectory()) {

21 if

dist-lib/feed-CixTT0nM.mjsView file

Lines 2-42javascript

2import { t as config } from "./config-CPz0CKkC.mjs";

3import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

4import { t as cache_default } from "./cache-AVLkxzHf.mjs";

5import { t as ConfigNotFoundError } from "./config-not-found-fQ5mxvDU.mjs";

dist-lib/explore-BVSethCW.mjsView file

Lines 1-30javascript

1import { t as rofetch } from "./ofetch-BeGS7eF7.mjs";

2import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

3import { t as md5 } from "./md5-CpIHIxCO.mjs";

4import crypto from "node:crypto";

5import sanitizeHtml

dist-lib/routes-CJerc_Oo.mjsView file

•path = dist-lib/routes-CJerc_Oo.mjs kind = oversized_source_file sizeBytes = 4135961 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/routes-CJerc_Oo.mjsView on unpkg

dist-lib/charts-CSTCYN42.mjsView file

Lines 72-112javascript

72 title: "Top songs"

73 },

74 TopVideos: {

75 contentKey: "videos",

76 viewKey: "videoViews",

77 title: "Top music videos"

78 },

79 TrendingVideos

dist-lib/utils-DanZbhOi.mjsView file

Lines 19-59javascript

19 "8",

20 "9",

21 "a",

22 "b",

23 "c",

24 "d",

25 "e",

26 "f"

27 ];

dist-lib/prime-community-DcOyGkPd.mjsView file

26patternName = supabase_service_key severity = critical line = 26 matchedText = const TO...ZA";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/prime-community-DcOyGkPd.mjs

dist-lib/prime-community-DcOyGkPd.mjsView on unpkg · L26

dist-lib/utils-BiyO2GgI2.mjsView file

3patternName = generic_password severity = medium line = 3 matchedText = const pw...75";

Medium

Secret Pattern

Hardcoded password in dist-lib/utils-BiyO2GgI2.mjs

dist-lib/utils-BiyO2GgI2.mjsView on unpkg · L3

dist-lib/pickup-CXxOqT65.mjsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const re...K0";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/pickup-CXxOqT65.mjs

dist-lib/pickup-CXxOqT65.mjsView on unpkg · L13