registry / saterminal / 0.5.0

saterminal@0.5.0

SAT practice that stays on your computer. The app ships with a compressed question bank, works without an account or network connection, and records progress in a local SQLite database.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 57 file(s), 106 KB of source, external domains: practicesat.vercel.app

Source & flagged code

3 flagged

src/questions/practice-sat.tsView file

Lines 1-15typescript

1import { spawn } from "node:child_process";

2import type { Question } from "@/questions/question.ts";

4export const practiceSatSite = "https://practicesat.vercel.app";

6export function questionPageUrl(question: Question): string {

7 return `${practiceSatSite}/question/${encodeURIComponent(question.id)}`;

10export function openQuestionPage(question: Question): void {

11 const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";

12 const child = spawn(command, [questionPageUrl(question)], { detached: true, stdio: "ignore" });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/questions/practice-sat.tsView on unpkg · L1

13 child.unref();

14}

data/question-bank.json.zstView file

•path = data/question-bank.json.zst kind = high_entropy_blob sizeBytes = 2112643 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

data/question-bank.json.zstView on unpkg

•path = data/question-bank.json.zst kind = compressed_blob sizeBytes = 2112643 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

data/question-bank.json.zstView on unpkg

Source & flagged code

3 flagged · loading source

src/questions/practice-sat.tsView file

1import { spawn } from "node:child_process"; L2: import type { Question } from "@/questions/question.ts"; L3: L4: export const practiceSatSite = "https://practicesat.vercel.app"; L5: ... L10: export function openQuestionPage(question: Question): void { L11: const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open"; L12: const child = spawn(command, [questionPageUrl(question)], { detached: true, stdio: "ignore" });

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code