registry / seo / 0.2.6

seo@0.2.6

The only SEO skill your agent needs. 50+ SEO audit tools through a local CLI and MCP server, using your own crawl, Search Console, and Google Analytics data.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 4.62 MB of source, external domains: 127.0.0.1, accounts.google.com, analyticsadmin.googleapis.com, analyticsdata.googleapis.com, api.dataforseo.com, api.jquery.com, api.semrush.com, chromeuxreport.googleapis.com, developer.mozilla.org, developers.google.com, dom.spec.whatwg.org, example.com, example.invalid, github.com, html.spec.whatwg.org, myaccount.google.com, oauth2.googleapis.com, openidconnect.googleapis.com, searchconsole.googleapis.com, seoskill.dev, status.search.google.com, www.googleapis.com, www.ibm.com, www.w3.org

Source & flagged code

5 flagged

dist/package-B9-D646K.jsView file

5026patternName = generic_password severity = medium line = 5026 matchedText = password...d]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/package-B9-D646K.jsView on unpkg · L5026

dist/index.jsView file

21import { gunzipSync } from "node:zlib"; L22: import { execFile } from "node:child_process"; L23: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L21

dist/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __seoCreateRequire } from 'node:module'; const require = __seoCreateRequire(import.meta.url);

3import{$ as e,$t as t,A as n,At as r,B as i,Bt as a,C as o,Ct as s,D as c,Dt as l,E as u,Et as d,F as f,Ft as p,G as m,Gt as ee,H as h,Ht as te,I as ne,It as re,J as ie,Jt as ae,K as g,Kt as oe,L as se,Lt as ce,M as

4`,`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L2

5`).split(`

6`).flatMap(e=>hr(e,n))}function gr(e,t){if(P(e)<=t)return e;let n=Math.max(1,t-P(`...`)),r=``;for(let t of e){if(P(`${r}${t}`)>n)break;r+=t}return`${r}...`}const _r={top:``,"top-mid":``,"top-left":``,"top-right":``,bottom:``,"bottom-mid":``,"bottom-left":``,"bottom-right":``,left:``,"left-mid":``,mid:``,"mid-mid":``,right:``,"right-mid":``,middle:``};function vr(e){return e===void 0?``:String(e)}function yr(e,t){return e.map((e,n)=>{let r=t.map(e=>vr(e[n]));return Math.min(42,Math.max(P(e),...r.map(P),4))})}function br(e,t,n){return e.length===0||e.length>4?!1:yr(e,t).reduce((e,t)=>e+t+2,0)<=n ...

7`)));return i.toString()}function Sr(e,t,n,r){let i=r.columns-n-2;return i<24?[r.colors.dim(e),...F(t,r.columns-2).map(e=>` ${e}`)]:F(t,i).map((t,i)=>{let a=i===0?e.padEnd(n):``.padEnd(n);return`${r.colors.dim(a)}${` `.repeat(2)}${t}`})}function Cr(e,t,n,r={}){let i=Math.min(28,Math.max(...e.map(e=>P(e)),0)),a=r.rowNumbers??t.length>1,o=String(t.length).length;return t.map((t,r)=>{let s=[];a&&s.push(n.colors.bold(String(r+1).padStart(o,`0`)));for(let[r,a]of e.entries())s.push(...Sr(a,vr(t[r]),i,n));return s.join(`

8`)}).join(`

10`)}function wr(e,t,n,r={}){return t.length===0?n.colors.dim(`No results.`):r.layout===`table`||r.layout!==`records`&&br(e,t,n)?xr(e,t,n):Cr(e,t,n,r)}function Tr(e,t){if(e.length===0)return``;let n=Math.min(28,Math.max(...e.map(([e])=>P(e))));return e.flatMap(([e,r])=>{let i=Sr(e,r,n,t);return i.length>0&&(i[0]=(i[0]??``).replace(e,t.colors.bold(e))),i}).join(`

11`)}function Er(e,t){let n=[t.colors.bold(e.title)];return e.body&&n.push(...F(e.body,t.columns)),e.command&&n.push(t.colors.cyan(gr(e.command,t.columns))),n.join(`

12`)}function Dr(e,t,n=`${t}s`){return e===1?t:n}function Or(e,t,n){let r=` `.repeat(t);return F(e,Math.max(1,n-t)).map(e=>`${r}${e}`)}function kr(e,t,n){return[t.colors.bold(e),...n?F(n,t.columns):[]].join(`

13`)}function Ar(e,t){let n={pass:t.colors.green,warn:t.colors.yellow,fail:t.colors.red};return e.map(e=>{let r=[`${n[e.status](e.status.toUpperCase().padEnd(4))} ${t.colors.bold(e.label)}`];if(r.push(...Or(e.detail,6,t.columns)),e.fix){let n=F(e.fix,Math.max(1,t.columns-11));r.push(...n.map((e,n)=>`${` `.repeat(6)}${n===0?`${t.colors.bold(`Fix`)} `:` `}${e}`))}return r.join(`

14`)}).join(`

16`)}function jr(e){let t=e.filter(e=>e.status===`pass`).length,n=e.filter(e=>e.status===`warn`).length,r=e.filter(e=>e.status===`fail`).length;return`${t} ${Dr(t,`check`)} passed, ${n} ${Dr(n,`warning`)}, ${r} failed.`}function Mr(e,t,n){let r=n.columns-t-2-2;return r<24||P(e.id)>t?[...Or(e.id,2,n.columns).map(e=>n.colors.cyan(e)),...Or(e.name,4,n.columns)].join(`

17`):F(e.name,r).map((r,i)=>{let a=i===0?e.id.padEnd(t):``.padEnd(t);return` ${n.colors.cyan(a)}${` `.repeat(2)}${r}`}).join(`

18`)}function Nr(e){let t=e.replaceAll(`-`,` `);return t.charAt(0).toUpperCase()+t.slice(1)}function Pr(e,t,n){let r=new Map;for(let t of e){let e=r.get(t.category)??[];e.push(t),r.set(t.category,e)}let i=`${e.length} ${Dr(e.length,n.noun)} across ${r.size} ${Dr(r.size,`category`,`categories`)}.`,a=Math.min(30,Math.max(...e.map(e=>P(e.id)),0)),o=Object.keys(n.categoryLabels??{}).filter(e=>r.has(e)),s=[...r.keys()].filter(e=>!o.includes(e));return[i,...[...o,...s].map(e=>{let i=r.get(e)??[],o=n.categoryLabels?.[e]??Nr(e);return[t.colors.bold(`${o} (${i.length})`),...i.map(e=>Mr(e,a,t))].join(`

19`)})].join(`

21`)}function Fr(e,t,n){return e.length===0?t.colors.dim(n.empty):e.map(e=>{let n=[t.colors.bold(e.title)];e.description&&n.push(...Or(e.description,2,t.columns));let r=e.meta?.filter(Boolean).join(` · `);return r&&n.push(...Or(r,2,t.columns).map(e=>t.colors.dim(e))),n.join(`

22`)}).join(`

Long lines were clipped for display.

dist/dist-PRmi6cXV.jsView file

2import { createRequire as __seoCreateRequire } from 'node:module'; const require = __seoCreateRequire(import.meta.url); L3: import{createRequire as e}from"node:module";import{Headers as t,fetch as n}from"undici";import{chmodSync as r,existsSync as i,mkdirSync as a,readFileSync as o,renameSync as s,rmSyn... L4: <html lang="en">

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dist-PRmi6cXV.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dist-PRmi6cXV.jsView on unpkg · L2

Source & flagged code

5 flagged · loading source

dist/package-B9-D646K.jsView file

5026patternName = generic_password severity = medium line = 5026 matchedText = password...d]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/package-B9-D646K.jsView on unpkg · L5026

dist/index.jsView file

21import { gunzipSync } from "node:zlib"; L22: import { execFile } from "node:child_process"; L23: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L21

dist/cli.jsView file

2import { createRequire as __seoCreateRequire } from 'node:module'; const require = __seoCreateRequire(import.meta.url); L3: import{$ as e,$t as t,A as n,At as r,B as i,Bt as a,C as o,Ct as s,D as c,Dt as l,E as u,Et as d,F as f,Ft as p,G as m,Gt as ee,H as h,Ht as te,I as ne,It as re,J as ie,Jt as ae,K ... L4: `,` ... L25: `)}function Lr(e,t,n){let r=t.flatMap(e=>F(e,Math.max(1,n.columns-2)).map((e,t)=>`${t===0?`- `:` `}${e}`));return[n.colors.bold(e),...r].join(` L26: `)}function Rr(e,t){return e.length===0?t.colors.dim(`No parameters.`):Fr(e.map(e=>({title:e.name,description:e.description,meta:[e.type,e.required?`required`:`optional`]})),t,{emp... L27: Top actions ... L33: What to check next L34: `),z([`Status`,`Check`,`Action`],e.topActions.map(e=>[e.status,e.title,K(e.action,96)]))),Y(`Caveats`,e.caveats)}const ai=x({meta:{name:`agent-readiness`,description:`Check content... L35: `);return}process.stdout.write(`Deleted local OAuth tokens. ... L68: Control comparison L69: `),R([[`Control`,e.control.change.title],[`Adjusted clicks`,e.control.adjusted.clickDelta===null?`n/a`:U(e.control.adjusted.clickDelta)],[`Adjusted click %`,e.control.adjusted.clic... L70: `)}\n`}const jo=

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L2

dist/dist-PRmi6cXV.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dist-PRmi6cXV.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dist-PRmi6cXV.jsView on unpkg · L2

Findings

4 High5 Medium5 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/dist-PRmi6cXV.js

HighCommand Output Exfiltrationdist/dist-PRmi6cXV.js

MediumSecret Patterndist/package-B9-D646K.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/package-B9-D646K.jsView file

5026patternName = generic_password severity = medium line = 5026 matchedText = password...d]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/package-B9-D646K.jsView on unpkg · L5026

dist/index.jsView file

21import { gunzipSync } from "node:zlib"; L22: import { execFile } from "node:child_process"; L23: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L21

dist/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __seoCreateRequire } from 'node:module'; const require = __seoCreateRequire(import.meta.url);

4`,`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L2

5`).split(`

8`)}).join(`

11`)}function Er(e,t){let n=[t.colors.bold(e.title)];return e.body&&n.push(...F(e.body,t.columns)),e.command&&n.push(t.colors.cyan(gr(e.command,t.columns))),n.join(`

14`)}).join(`

17`):F(e.name,r).map((r,i)=>{let a=i===0?e.id.padEnd(t):``.padEnd(t);return` ${n.colors.cyan(a)}${` `.repeat(2)}${r}`}).join(`

19`)})].join(`

22`)}).join(`

Long lines were clipped for display.

dist/dist-PRmi6cXV.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dist-PRmi6cXV.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dist-PRmi6cXV.jsView on unpkg · L2