runlot@0.1.0-rc.11
⚠ Under reviewrunlot CLI — 앱 배포와 PostgreSQL 관리
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
3 flaggeddist/index.jsView file
5880"buffer",
L5881: "child_process",
L5882: "cluster",
High
346"use strict";
L347: var bufferFrom = Buffer.from || Buffer;
L348: module.exports = function parseBytea(input) {
...
L766: if (!isUTC) {
L767: result.setTime(result.getTime() + result.getTimezoneOffset() * 6e4);
L768: }
...
L973: try {
L974: user = process.platform === "win32" ? process.env.USERNAME : process.env.USER;
L975: } catch {
...
L996: binary: false,
L997: // Connection pool options - see https://github.com/brianc/node-pg-pool
L998: // number of connections to use in connection pool
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L3462import { createRequire as __runlotCreateRequire } from "node:module";
L3: const require = __runlotCreateRequire(import.meta.url);
L4: var __create = Object.create;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsFindings
3 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighCommand Output Exfiltrationdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to runlot@0.1.0-rc.11.
See all versions of runlot for other recorded verdicts.
- Review the evidence and your use of runlot@0.1.0-rc.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.