registry / seo / 0.2.4

seo@0.2.4

⚠ Under review

The only SEO skill your agent needs. 50+ SEO audit tools through a local CLI and MCP server, using your own crawl, Search Console, and GA4 data.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 4.59 MB of source, external domains: 127.0.0.1, accounts.google.com, analyticsadmin.googleapis.com, analyticsdata.googleapis.com, api.dataforseo.com, api.jquery.com, api.semrush.com, chromeuxreport.googleapis.com, developer.mozilla.org, developers.google.com, dom.spec.whatwg.org, example.com, example.invalid, github.com, html.spec.whatwg.org, myaccount.google.com, oauth2.googleapis.com, openidconnect.googleapis.com, searchconsole.googleapis.com, status.search.google.com, www.googleapis.com, www.ibm.com, www.w3.org

Source & flagged code

6 flagged

dist/package-D6bCOqrD.jsView file

5026patternName = generic_password severity = medium line = 5026 matchedText = password...d]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/package-D6bCOqrD.jsView on unpkg · L5026

dist/dist-DMSBrZYd.jsView file

2import { createRequire as __seoCreateRequire } from 'node:module'; const require = __seoCreateRequire(import.meta.url); L3: import{createRequire as e}from"node:module";import{Headers as t,fetch as n}from"undici";import{chmodSync as r,existsSync as i,mkdirSync as a,readFileSync as o,renameSync as s,rmSyn... L4: <html lang="en">

High

Child Process

Package source references child process execution.

dist/dist-DMSBrZYd.jsView on unpkg · L2

Source & flagged code

6 flagged · loading source

dist/package-D6bCOqrD.jsView file

5026patternName = generic_password severity = medium line = 5026 matchedText = password...d]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/package-D6bCOqrD.jsView on unpkg · L5026

dist/dist-DMSBrZYd.jsView file

High

Child Process

Package source references child process execution.

dist/dist-DMSBrZYd.jsView on unpkg · L2

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dist-DMSBrZYd.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dist-DMSBrZYd.jsView on unpkg · L2

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = seo@0.1.0 matchedIdentity = npm:c2Vv:0.1.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

2import { createRequire as __seoCreateRequire } from 'node:module'; const require = __seoCreateRequire(import.meta.url); L3: import{$ as e,$t as t,A as n,At as r,B as i,Bt as a,C as o,Ct as s,D as c,Dt as l,E as u,Et as d,F as f,Ft as p,G as m,Gt as h,H as ee,Ht as g,I as te,It as ne,J as re,Jt as ie,K a... L4: `,` ... L25: `)}function Tr(e,t,n){let r=t.flatMap(e=>F(e,Math.max(1,n.columns-2)).map((e,t)=>`${t===0?`- `:` `}${e}`));return[n.colors.bold(e),...r].join(` L26: `)}function Er(e,t){return e.length===0?t.colors.dim(`No parameters.`):Cr(e.map(e=>({title:e.name,description:e.description,meta:[e.type,e.required?`required`:`optional`]})),t,{emp... L27: Top actions ... L33: What to check next L34: `),z([`Status`,`Check`,`Action`],e.topActions.map(e=>[e.status,e.title,K(e.action,96)]))),Y(`Caveats`,e.caveats)}const Jr=x({meta:{name:`agent-readiness`,description:`Check content... L35: `);return}process.stdout.write(`Deleted local OAuth tokens. ... L69: Control comparison L70: `),R([[`Control`,e.control.change.title],[`Adjusted clicks`,e.control.adjusted.clickDelta===null?`n/a`:U(e.control.adjusted.clickDelta)],[`Adjusted click %`,e.control.adjusted.clic... L71: `)}\n`}const go=

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L2

Findings

1 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/dist-DMSBrZYd.js

HighShell

HighSame File Env Network Executiondist/dist-DMSBrZYd.js

HighCommand Output Exfiltrationdist/dist-DMSBrZYd.js

MediumSecret Patterndist/package-D6bCOqrD.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

dist/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __seoCreateRequire } from 'node:module'; const require = __seoCreateRequire(import.meta.url);

3import{$ as e,$t as t,A as n,At as r,B as i,Bt as a,C as o,Ct as s,D as c,Dt as l,E as u,Et as d,F as f,Ft as p,G as m,Gt as h,H as ee,Ht as g,I as te,It as ne,J as re,Jt as ie,K as ae,Kt as oe,L as se,Lt as ce,M as le,Mt as ue,N as de,Nt as fe,O as pe,Ot as me,P as he,Pt as ge,Q as _e,Qt as ve,R as ye,Rt as be,S as xe,St as Se,T as Ce,Tt as we,U as Te,Ut as Ee,V as De,Vt as Oe,W as ke,Wt as Ae,X as je,Xt as Me,Y as Ne,Yt as Pe,Z as Fe,Zt as Ie,_ as Le,_t as Re,a as ze,an as Be,at as Ve,b as He,bt as Ue,c as We,cn as Ge,ct as Ke,d as qe,dt as Je,en as Ye,et as Xe,f as Ze,ft as Qe,g as $e,gt as ...

4`,`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L2

5`).split(`

6`).flatMap(e=>rr(e,n))}function ir(e,t){if(P(e)<=t)return e;let n=Math.max(1,t-P(`...`)),r=``;for(let t of e){if(P(`${r}${t}`)>n)break;r+=t}return`${r}...`}const ar={top:``,"top-mid":``,"top-left":``,"top-right":``,bottom:``,"bottom-mid":``,"bottom-left":``,"bottom-right":``,left:``,"left-mid":``,mid:``,"mid-mid":``,right:``,"right-mid":``,middle:``};function or(e){return e===void 0?``:String(e)}function sr(e,t){return e.map((e,n)=>{let r=t.map(e=>or(e[n]));return Math.min(42,Math.max(P(e),...r.map(P),4))})}function cr(e,t,n){return e.length===0||e.length>4?!1:sr(e,t).reduce((e,t)=>e+t+2,0)<=n ...

7`)));return i.toString()}function ur(e,t,n,r){let i=r.columns-n-2;return i<24?[r.colors.dim(e),...F(t,r.columns-2).map(e=>` ${e}`)]:F(t,i).map((t,i)=>{let a=i===0?e.padEnd(n):``.padEnd(n);return`${r.colors.dim(a)}${` `.repeat(2)}${t}`})}function dr(e,t,n,r={}){let i=Math.min(28,Math.max(...e.map(e=>P(e)),0)),a=r.rowNumbers??t.length>1,o=String(t.length).length;return t.map((t,r)=>{let s=[];a&&s.push(n.colors.bold(String(r+1).padStart(o,`0`)));for(let[r,a]of e.entries())s.push(...ur(a,or(t[r]),i,n));return s.join(`

8`)}).join(`

10`)}function fr(e,t,n,r={}){return t.length===0?n.colors.dim(`No results.`):r.layout===`table`||r.layout!==`records`&&cr(e,t,n)?lr(e,t,n):dr(e,t,n,r)}function pr(e,t){if(e.length===0)return``;let n=Math.min(28,Math.max(...e.map(([e])=>P(e))));return e.flatMap(([e,r])=>{let i=ur(e,r,n,t);return i.length>0&&(i[0]=(i[0]??``).replace(e,t.colors.bold(e))),i}).join(`

11`)}function mr(e,t){let n=[t.colors.bold(e.title)];return e.body&&n.push(...F(e.body,t.columns)),e.command&&n.push(t.colors.cyan(ir(e.command,t.columns))),n.join(`

12`)}function hr(e,t,n=`${t}s`){return e===1?t:n}function gr(e,t,n){let r=` `.repeat(t);return F(e,Math.max(1,n-t)).map(e=>`${r}${e}`)}function _r(e,t,n){return[t.colors.bold(e),...n?F(n,t.columns):[]].join(`

13`)}function vr(e,t){let n={pass:t.colors.green,warn:t.colors.yellow,fail:t.colors.red};return e.map(e=>{let r=[`${n[e.status](e.status.toUpperCase().padEnd(4))} ${t.colors.bold(e.label)}`];if(r.push(...gr(e.detail,6,t.columns)),e.fix){let n=F(e.fix,Math.max(1,t.columns-11));r.push(...n.map((e,n)=>`${` `.repeat(6)}${n===0?`${t.colors.bold(`Fix`)} `:` `}${e}`))}return r.join(`

14`)}).join(`

16`)}function yr(e){let t=e.filter(e=>e.status===`pass`).length,n=e.filter(e=>e.status===`warn`).length,r=e.filter(e=>e.status===`fail`).length;return`${t} ${hr(t,`check`)} passed, ${n} ${hr(n,`warning`)}, ${r} failed.`}function br(e,t,n){let r=n.columns-t-2-2;return r<24||P(e.id)>t?[...gr(e.id,2,n.columns).map(e=>n.colors.cyan(e)),...gr(e.name,4,n.columns)].join(`

17`):F(e.name,r).map((r,i)=>{let a=i===0?e.id.padEnd(t):``.padEnd(t);return` ${n.colors.cyan(a)}${` `.repeat(2)}${r}`}).join(`

18`)}function xr(e){let t=e.replaceAll(`-`,` `);return t.charAt(0).toUpperCase()+t.slice(1)}function Sr(e,t,n){let r=new Map;for(let t of e){let e=r.get(t.category)??[];e.push(t),r.set(t.category,e)}let i=`${e.length} ${hr(e.length,n.noun)} across ${r.size} ${hr(r.size,`category`,`categories`)}.`,a=Math.min(30,Math.max(...e.map(e=>P(e.id)),0)),o=Object.keys(n.categoryLabels??{}).filter(e=>r.has(e)),s=[...r.keys()].filter(e=>!o.includes(e));return[i,...[...o,...s].map(e=>{let i=r.get(e)??[],o=n.categoryLabels?.[e]??xr(e);return[t.colors.bold(`${o} (${i.length})`),...i.map(e=>br(e,a,t))].join(`

19`)})].join(`

21`)}function Cr(e,t,n){return e.length===0?t.colors.dim(n.empty):e.map(e=>{let n=[t.colors.bold(e.title)];e.description&&n.push(...gr(e.description,2,t.columns));let r=e.meta?.filter(Boolean).join(` · `);return r&&n.push(...gr(r,2,t.columns).map(e=>t.colors.dim(e))),n.join(`

22`)}).join(`

Long lines were clipped for display.

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg