Static Scan Results
scanned 3h ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsShell
HighEntropyStringsObfuscatedUrlStrings
Oversized source lightweight scan
dist/token-goat.mjs10.7 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsHighEntropyStrings
Source & flagged code
5 flagged · loading sourcedist/token-goat-hook.mjsView file
237init_define_import_meta_env();
L238: var childProcess = __require("child_process");
L239: var { isLinux, getReport } = require_process();
High
Child Process
Package source references child process execution.
dist/token-goat-hook.mjsView on unpkg · L2371972encoding: "utf8",
L1973: shell: true
L1974: };
High
237init_define_import_meta_env();
L238: var childProcess = __require("child_process");
L239: var { isLinux, getReport } = require_process();
...
L7525: // changes what makes a lock file "belong" to a holder, only how fresh its mtime looks.
L7526: if (fs.readFileSync(lockPath, 'utf8') === token) fs.writeFileSync(lockPath, token)
L7527: } catch {}
...
L21658: }
L21659: function pathRewrite(path24, rewriter, baseUrl, metadata, elem) {
L21660: const modifiedPath = typeof rewriter === "function" ? rewriter(path24, metadata, elem) : path24;
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/token-goat-hook.mjsView on unpkg · L237dist/token-goat.mjsView file
•path = dist/token-goat.mjs
kind = oversized_source_file
sizeBytes = 11189859
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/token-goat.mjsView on unpkg•path = dist/token-goat.mjs
kind = oversized_cli_entrypoint
sizeBytes = 11189859
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/token-goat.mjsView on unpkgFindings
4 High3 Medium5 Low
HighChild Processdist/token-goat-hook.mjs
HighShelldist/token-goat-hook.mjs
HighRemote Agent Bridgedist/token-goat-hook.mjs
HighOversized Source Filedist/token-goat.mjs
MediumEnvironment Vars
MediumOversized Cli Entrypointdist/token-goat.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings