Static Scan Results
scanned 4h ago · by rust-scannerStatic analysis flagged 50 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Oversized source lightweight scan
dist/dist-DmzuSdk3.js4.72 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringscli.github.comgithub.compi.dev
dist/dist-niRQNrwJ.js2.01 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsWebSocketHighEntropyStringsUrlStrings127.0.0.1accounts.google.comapi.anthropic.comapi.cerebras.aiapi.groq.comapi.individual.githubcopilot.comapi.kimi.comapi.minimax.ioapi.minimaxi.comapi.mistral.aiapi.openai.comauth.openai.combedrock-runtime.us-east-1.amazonaws.comchatgpt.comclaude.aicloudcode-pa.googleapis.comconsole.anthropic.comdaily-cloudcode-pa.sandbox.googleapis.comgenerativelanguage.googleapis.comgoo.gleoauth2.googleapis.comopencode.airouter.huggingface.cowww.googleapis.com
dist/login-qr-Bq6nob7r.js3.90 MB file, sampled 256 KB
FilesystemChildProcessEvalCryptoShellWebSocket
dist/opus-ml-BT8HD4Wf.js3.91 MB file, sampled 256 KB
HighEntropyStrings
dist/plugin-sdk/index.js7.98 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsskykoi.com
dist/plugin-sdk/opus-ml-0BycUTjo.js3.91 MB file, sampled 256 KB
HighEntropyStrings
dist/plugin-sdk/pi-model-discovery-lynj0LAO.js5.86 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsapi.anthropic.comapi.cerebras.aiapi.github.comapi.groq.comapi.individual.githubcopilot.comapi.kimi.comapi.minimax.ioapi.minimaxi.comapi.mistral.aiapi.openai.combedrock-runtime.us-east-1.amazonaws.comchatgpt.comcloudcode-pa.googleapis.comcodeload.github.comdaily-cloudcode-pa.sandbox.googleapis.comgenerativelanguage.googleapis.comgist.githubusercontent.comgithub.comopencode.airouter.huggingface.co
dist/pw-ai-ByKRZUzk.js4.20 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsEvalCryptoDynamicRequireHighEntropyStringsUrlStringsdotenvx.comwww.apache.org
dist/reply-CfA8e7Pe.js5.28 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoShellHighEntropyStringsUrlStringsapi.deepgram.comapi.groq.comapi.openai.comexample.comgenerativelanguage.googleapis.com
Source & flagged code
41 flagged · loading sourcedist/dist-BJQ4qJgE.jsView file
20273patternName = aws_access_key
severity = critical
line = 20273
matchedText = var Q = ...==";
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/dist-BJQ4qJgE.jsView on unpkg · L2027320273patternName = aws_access_key
severity = critical
line = 20273
matchedText = var Q = ...==";
Critical
5import { t as require_proxy_from_env } from "./proxy-from-env-NVPRlS0s.js";
L6: import { n as __filename, r as init_esm_shims, t as __dirname } from "./esm-shims-CCgr543I.js";
L7: import { t as require_source_map } from "./source-map-B_vA6VVS.js";
...
L240: this.requireSize = (k, v, size, sizeCalculation) => {
L241: if (this.isBackgroundFetch(v)) return 0;
L242: if (!isPosInt(size)) if (sizeCalculation) {
...
L818: const auth = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
L819: headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;
L820: }
...
L1910: else this._ensureWriteable(byteLength, offsetVal);
L1911: this._buff.write(value, offsetVal, byteLength, encodingVal);
L1912: if (isInsert) this._writeOffset += byteLength;
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/dist-BJQ4qJgE.jsView on unpkg · L5dist/ensure-local-gateway-B2qYYNsm.jsView file
9import { mkdirSync, openSync } from "node:fs";
L10: import { spawn } from "node:child_process";
L11: import { Writable } from "node:stream";
High
Child Process
Package source references child process execution.
dist/ensure-local-gateway-B2qYYNsm.jsView on unpkg · L9dist/daemon-runtime-jkMiwykI.jsView file
454function gatewayInstallErrorHint(platform = process.platform) {
L455: return platform === "win32" ? "Tip: rerun from an elevated PowerShell (Start → type PowerShell → right-click → Run as administrator) or skip service install." : `Tip: rerun \`${for...
L456: }
High
8import fs from "node:fs/promises";
L9: import { execFile } from "node:child_process";
L10:
...
L97: const { execFileSync } = await import("node:child_process");
L98: const cmd = process.platform === "win32" ? "where" : "which";
L99: try {
...
L107: } catch {
L108: if (binary === "bun") throw new Error("Bun not found in PATH. Install bun: https://bun.sh");
L109: throw new Error("Node not found in PATH. Install Node 22+.");
...
L240: try {
L241: const { stdout } = await execFileImpl(nodePath, ["-p", "process.versions.node"], { encoding: "utf8" });
L242: const value = stdout.trim();
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/daemon-runtime-jkMiwykI.jsView on unpkg · L8dist/plugin-sdk/photon_rs-DWHUUvNo.jsView file
4179module.exports.__wbg_newnoargs_e643855c6572a4a8 = function(arg0, arg1) {
L4180: return new Function(getStringFromWasm0(arg0, arg1));
L4181: };
High
Eval
Package source references dynamic code evaluation.
dist/plugin-sdk/photon_rs-DWHUUvNo.jsView on unpkg · L4179dist/event-streams-Rl1ERUF4.jsView file
481*/
L482: const URL$1 = __require("url");
L483: const VM = __require("vm");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/event-streams-Rl1ERUF4.jsView on unpkg · L48144};
L45: serializer.write(requestSchema, initialRequest);
L46: const body = serializer.flush();
...
L215: let t = (e + 42) % 256;
L216: 0 === t || 10 === t || 13 === t || 61 === t ? n.push("=" + String.fromCharCode((t + 64) % 256)) : n.push(String.fromCharCode(t));
L217: }
...
L275: const n = "Decode failed crc32 validation";
L276: throw console.error("`simple-yenc`\n", n + "\n", "Expected: " + l + "; Got: " + t + "\n", "Visit https://github.com/eshaz/simple-yenc for more information"), Error(n);
L277: }
...
L526: module.exports = threads.isMainThread ? mainThread() : workerThread();
L527: const baseUrl = URL$1.pathToFileURL(process.cwd() + "/");
L528: function mainThread() {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/event-streams-Rl1ERUF4.jsView on unpkg · L44dist/config-guard-_bkiEZ2R.jsView file
302await prompter.intro("Add SKYKOI koi");
L303: const name = nameInput ?? await prompter.text({
L304: message: "Koi name",
...
L402: if (result.conflicts.length > 0) await prompter.note(["Skipped bindings already claimed by another koi:", ...result.conflicts.map((conflict) => `- ${describeBinding(conflict.bindin...
L403: } else await prompter.note(["Routing unchanged. Add bindings when you're ready.", "Docs: https://docs.skykoi.com/concepts/multi-koi"].join("\n"), "Routing");
L404: await writeConfigFile(nextConfig);
...
L524: } else if (workspaceRaw) workspaceDir = normalizeWorkspacePath(workspaceRaw);
L525: else if (wantsIdentityFile || !koiRaw) workspaceDir = path.resolve(process.cwd());
L526: let koiId = koiRaw ? normalizeKoiId(koiRaw) : void 0;
...
L985: query: normalizeQuery(params.query),
L986: body: params.body,
L987: timeoutMs: resolvedTimeout
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/config-guard-_bkiEZ2R.jsView on unpkg · L302dist/plugin-sdk/dist-cjs-0eT73s39.jsView file
64if (response.statusCode === 200) {
L65: const parsed = JSON.parse(str);
L66: if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") throw new pro...
...
L119: const AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
L120: const DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2";
L121: const AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
...
L126: let host;
L127: const relative = options.[redacted] ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
L128: const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/plugin-sdk/dist-cjs-0eT73s39.jsView on unpkg · L64dist/gateway-cli-C-KfNrgk.jsView file
59import "./tui-fast-lane-Ev2oUXQf.js";
L60: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-Bxhfs1xr.js";
L61: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-Cz2pl07T.js";
L62: import { $ as validateNodePairListParams, A as [redacted], At as errorShape, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L63: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-BTi_uq-4.js";
...
L84: import { n as resolveMessageChannelSelection } from "./channel-selection-BSuFqCaq.js";
L85: import { g as isPrivateMode, h as isAudioMuted, v as setAudioMuted, y as setPrivateMode } from "./identify-DFi1kVgv.js";
L86: import "./registry-BwlCjCgP.js";
...
L146: import { execFile, spawn, spawnSync } from "node:child_process";
L147: import { WebSocketServer } from "ws";
L148: import crypto, { createHash, randomUUID } from "node:crypto";
...
L207: });
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/gateway-cli-C-KfNrgk.jsView on unpkg · L59•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/register.subclis-ceKpisEU.js -> dist/gateway-cli-C-KfNrgk.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/gateway-cli-C-KfNrgk.jsView on unpkgdist/tui-KKclAOTp.jsView file
26import os, { homedir, tmpdir } from "node:os";
L27: import { execFile, spawn } from "node:child_process";
L28: import { randomUUID } from "node:crypto";
...
L63: function terminalColumns() {
L64: const cols = process.stdout?.columns;
L65: if (typeof cols === "number" && Number.isFinite(cols) && cols > 0) return Math.floor(cols);
...
L1707: for (let i = 0; i < input.length; i++) {
L1708: hash ^= input.charCodeAt(i);
L1709: hash = Math.imul(hash, 16777619);
...
L1951: clientVersion: VERSION,
L1952: platform: process.platform,
L1953: mode: GATEWAY_CLIENT_MODES.UI,
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/tui-KKclAOTp.jsView on unpkg · L2626Cross-file remote execution chain: dist/tui-KKclAOTp.js spawns dist/lib-DXDl0UwS.js; helper contains network access plus dynamic code execution.
L26: import os, { homedir, tmpdir } from "node:os";
L27: import { execFile, spawn } from "node:child_process";
L28: import { randomUUID } from "node:crypto";
...
L63: function terminalColumns() {
L64: const cols = process.stdout?.columns;
L65: if (typeof cols === "number" && Number.isFinite(cols) && cols > 0) return Math.floor(cols);
...
L1707: for (let i = 0; i < input.length; i++) {
L1708: hash ^= input.charCodeAt(i);
L1709: hash = Math.imul(hash, 16777619);
...
L1951: clientVersion: VERSION,
L1952: platform: process.platform,
L1953: mode: GATEWAY_CLIENT_MODES.UI,
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/tui-KKclAOTp.jsView on unpkg · L26skills/model-usage/scripts/model_usage.pyView file
•path = skills/model-usage/scripts/model_usage.py
kind = build_helper
sizeBytes = 10483
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/model-usage/scripts/model_usage.pyView on unpkgdist/pw-ai-ByKRZUzk.jsView file
•path = dist/pw-ai-ByKRZUzk.js
kind = oversized_source_file
sizeBytes = 4402452
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/pw-ai-ByKRZUzk.jsView on unpkgdist/plugin-sdk/dist-C2SauqMb.jsView file
22264patternName = aws_access_key
severity = critical
line = 22264
matchedText = var Q = ...==";
Critical
Secret Pattern
AWS access key ID in dist/plugin-sdk/dist-C2SauqMb.js
dist/plugin-sdk/dist-C2SauqMb.jsView on unpkg · L22264dist/esm-DqRYstC3.jsView file
5594patternName = generic_password
severity = medium
line = 5594
matchedText = password...d]",
Medium
docs/zh-CN/help/faq.mdView file
2191patternName = generic_password
severity = medium
line = 2191
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in docs/zh-CN/help/faq.md
docs/zh-CN/help/faq.mdView on unpkg · L2191docs/zh-CN/gateway/tailscale.mdView file
80patternName = generic_password
severity = medium
line = 80
matchedText = auth: { ..." },
Medium
Secret Pattern
Hardcoded password in docs/zh-CN/gateway/tailscale.md
docs/zh-CN/gateway/tailscale.mdView on unpkg · L80docs/zh-CN/gateway/configuration.mdView file
2967patternName = generic_password
severity = medium
line = 2967
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in docs/zh-CN/gateway/configuration.md
docs/zh-CN/gateway/configuration.mdView on unpkg · L2967docs/zh-CN/channels/bluebubbles.mdView file
43patternName = generic_password
severity = medium
line = 43
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in docs/zh-CN/channels/bluebubbles.md
docs/zh-CN/channels/bluebubbles.mdView on unpkg · L43docs/help/faq.mdView file
2387patternName = generic_password
severity = medium
line = 2387
matchedText = password...rd",
Medium
docs/gateway/tailscale.mdView file
81patternName = generic_password
severity = medium
line = 81
matchedText = auth: { ..." },
Medium
Secret Pattern
Hardcoded password in docs/gateway/tailscale.md
docs/gateway/tailscale.mdView on unpkg · L81docs/gateway/configuration.mdView file
3050patternName = generic_password
severity = medium
line = 3050
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in docs/gateway/configuration.md
docs/gateway/configuration.mdView on unpkg · L3050docs/channels/bluebubbles.mdView file
37patternName = generic_password
severity = medium
line = 37
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in docs/channels/bluebubbles.md
docs/channels/bluebubbles.mdView on unpkg · L37extensions/bluebubbles/src/attachments.test.tsView file
34patternName = generic_password
severity = medium
line = 34
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.tsView on unpkg · L3444patternName = generic_password
severity = medium
line = 44
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.tsView on unpkg · L4476patternName = generic_password
severity = medium
line = 76
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.tsView on unpkg · L7698patternName = generic_password
severity = medium
line = 98
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.tsView on unpkg · L98228patternName = generic_password
severity = medium
line = 228
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.tsView on unpkg · L228extensions/bluebubbles/src/send.test.tsView file
847patternName = generic_password
severity = medium
line = 847
matchedText = password...ss",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/send.test.ts
extensions/bluebubbles/src/send.test.tsView on unpkg · L847extensions/bluebubbles/src/monitor.test.tsView file
241patternName = generic_password
severity = medium
line = 241
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.tsView on unpkg · L241439patternName = generic_password
severity = medium
line = 439
matchedText = const ac... });
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.tsView on unpkg · L439475patternName = generic_password
severity = medium
line = 475
matchedText = const ac... });
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.tsView on unpkg · L475515patternName = generic_password
severity = medium
line = 515
matchedText = const ac... });
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.tsView on unpkg · L515550patternName = generic_password
severity = medium
line = 550
matchedText = const ac... });
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.tsView on unpkg · L550extensions/bluebubbles/src/actions.test.tsView file
72patternName = generic_password
severity = medium
line = 72
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/actions.test.ts
extensions/bluebubbles/src/actions.test.tsView on unpkg · L7286patternName = generic_password
severity = medium
line = 86
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/actions.test.ts
extensions/bluebubbles/src/actions.test.tsView on unpkg · L86159patternName = generic_password
severity = medium
line = 159
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in extensions/bluebubbles/src/actions.test.ts
extensions/bluebubbles/src/actions.test.tsView on unpkg · L159Findings
5 Critical8 High30 Medium7 Low
CriticalCritical Secretdist/dist-BJQ4qJgE.js
CriticalRemote Asset Decode Executedist/gateway-cli-C-KfNrgk.js
CriticalTrigger Reachable Dangerous Capabilitydist/gateway-cli-C-KfNrgk.js
CriticalSecret Patterndist/dist-BJQ4qJgE.js
CriticalSecret Patterndist/plugin-sdk/dist-C2SauqMb.js
HighChild Processdist/ensure-local-gateway-B2qYYNsm.js
HighShelldist/daemon-runtime-jkMiwykI.js
HighEvaldist/plugin-sdk/photon_rs-DWHUUvNo.js
HighSandbox Evasion Gated Capabilitydist/daemon-runtime-jkMiwykI.js
HighCloud Metadata Accessdist/plugin-sdk/dist-cjs-0eT73s39.js
HighObfuscated Payload Loaderdist/tui-KKclAOTp.js
HighCross File Remote Execution Contextdist/tui-KKclAOTp.js
HighOversized Source Filedist/pw-ai-ByKRZUzk.js
MediumDynamic Requiredist/event-streams-Rl1ERUF4.js
MediumUnsafe Vm Contextdist/event-streams-Rl1ERUF4.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/config-guard-_bkiEZ2R.js
MediumShips Build Helperskills/model-usage/scripts/model_usage.py
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/esm-DqRYstC3.js
MediumSecret Patterndocs/zh-CN/help/faq.md
MediumSecret Patterndocs/zh-CN/gateway/tailscale.md
MediumSecret Patterndocs/zh-CN/gateway/configuration.md
MediumSecret Patterndocs/zh-CN/channels/bluebubbles.md
MediumSecret Patterndocs/help/faq.md
MediumSecret Patterndocs/gateway/tailscale.md
MediumSecret Patterndocs/gateway/configuration.md
MediumSecret Patterndocs/channels/bluebubbles.md
MediumSecret Patternextensions/bluebubbles/src/attachments.test.ts
MediumSecret Patternextensions/bluebubbles/src/attachments.test.ts
MediumSecret Patternextensions/bluebubbles/src/attachments.test.ts
MediumSecret Patternextensions/bluebubbles/src/attachments.test.ts
MediumSecret Patternextensions/bluebubbles/src/attachments.test.ts
MediumSecret Patternextensions/bluebubbles/src/send.test.ts
MediumSecret Patternextensions/bluebubbles/src/monitor.test.ts
MediumSecret Patternextensions/bluebubbles/src/monitor.test.ts
MediumSecret Patternextensions/bluebubbles/src/monitor.test.ts
MediumSecret Patternextensions/bluebubbles/src/monitor.test.ts
MediumSecret Patternextensions/bluebubbles/src/monitor.test.ts
MediumSecret Patternextensions/bluebubbles/src/actions.test.ts
MediumSecret Patternextensions/bluebubbles/src/actions.test.ts
MediumSecret Patternextensions/bluebubbles/src/actions.test.ts
LowScripts Present
LowWeak Cryptodist/dist-BJQ4qJgE.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings