registry / sap-ux-sap-systems-ext / 1.0.22
sap-ux-sap-systems-ext@1.0.22
⚠ Under reviewEnables you to store connection information for remote SAP systems.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Oversized source lightweight scan
dist/extension.js9.86 MB file, sampled 256 KB
FilesystemNetworkEnvironmentVarsDynamicRequireHighEntropyStringsUrlStringsejs.cofeross.orgga.support.sap.comgithub.comhelp.sap.comlodash.com
Source & flagged code
4 flaggeddist/webapp/store.jsView file
74patternName = generic_password
severity = medium
line = 74
Medium
dist/zowe-keyring-wrapper.jsView file
5L6: const { join } = require('path');
L7: const { existsSync } = require('fs');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/zowe-keyring-wrapper.jsView on unpkg · L5prebuilds/keyring.linux-x64-musl.nodeView file
•path = prebuilds/keyring.linux-x64-musl.node
kind = native_binary
sizeBytes = 393832
magicHex = [redacted]
Findings
7 Medium6 Low
MediumSecret Patterndist/webapp/store.js
MediumDynamic Requiredist/zowe-keyring-wrapper.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryprebuilds/keyring.linux-x64-musl.node
MediumOversized Source Filedist/extension.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to sap-ux-sap-systems-ext@1.0.22.
See all versions of sap-ux-sap-systems-ext for other recorded verdicts.
- Review the evidence and your use of sap-ux-sap-systems-ext@1.0.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.