registry / sugaku-mail / 3.1.0

sugaku-mail@3.1.0

⚠ Under review

sugaku-mail — Gmail自動転送・SMTP送信対応

Static Scan Results

scanned 10h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 23.1 KB of source, external domains: npm.sugaku-club.com, registry.npmjs.org

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

3const { send, fetchInbox, fetchMessage, setup, testSmtp, config, load } = require('../lib/index');

4const readline = require('readline');

5const { execSync } = require('child_process');

6const https = require('https');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

7const args = process.argv.slice(2);

8const PKG_NAME = 'sugaku-mail';

9const PKG_VERSION = '3.1.0';

11const C = {

12 reset:'\x1b[0m', bold:'\x1b[1m', dim:'\x1b[2m',

13 cyan:'\x1b[36m', green:'\x1b[32m', red:'\x1b[31m',

14 yellow:'\x1b[33m', white:'\x1b[37m', magenta:'\x1b[35m',

15};

16const cc = (c,s) => c+s+C.reset;

17function cls() { process.stdout.write('\x1Bc'); }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cli.jsView on unpkg · L4

19let rl;

20function makeRL() {

21 if(rl) try{rl.close();}catch{}

22 rl = readline.createInterface({input:process.stdin,output:process.stdout});

23 rl.on('SIGINT',()=>{console.log('\n\n さようなら 👋\n');process.exit(0);});

24 return rl;

Lines 70-110javascript

71async function checkAndUpdate() {

72 process.stdout.write(cc(C.dim,' 更新確認中…'));

73 const latest = await getLatestVersion();

74 process.stdout.

•matchType = previous_version_dangerous_delta matchedPackage = sugaku-mail@2.7.0 matchedIdentity = npm:c3VnYWt1LW1haWw:2.7.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code