registry  /  tovuk  /  0.1.111

tovuk@0.1.111

Use Tovuk scraper APIs from a native CLI.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 8.61 KB of source, external domains: docs.tovuk.com, github.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/tovuk.mjsView file
1#!/usr/bin/env node L2: import { spawnSync } from 'node:child_process' L3: import { existsSync } from 'node:fs' ... L7: const binDir = dirname(fileURLToPath(import.meta.url)) L8: const nativeBinary = join(binDir, process.platform === 'win32' ? 'tovuk-native.exe' : 'tovuk-native') L9: ... L36: agent_instruction: 'Reinstall with npm scripts enabled, install from GitHub Releases, Homebrew, Cargo, or rerun with TOVUK_NATIVE_BINARY pointing to a supported native binary.', L37: docs_url: 'https://docs.tovuk.com/reference/packages', L38: checkout_url: null, ... L61: function jsonOutputRequested() { L62: if (/^json$/i.test(process.env.TOVUK_OUTPUT ?? '')) { L63: return true
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/tovuk.mjsView on unpkg · L1

Findings

2 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitybin/tovuk.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings