viveworker: Suspicious npm security report (Warn)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 2.22 MB of source, external domains: 127.0.0.1, a2a.viveworker.com, api.hazbase.com, api.npmjs.org, lp.hazbase.com, ntfy.sh, pairing.viveworker.com, registry.npmjs.org, relay.local, share.viveworker.com, viveworker.com, viveworker.local, www.apple.com, www.moltbook.com, www.w3.org

Source & flagged code

4 flagged

scripts/viveworker-bridge.mjsView file

2L3: import { spawn } from "node:child_process"; L4: import crypto from "node:crypto"; L5: import { createServer as createHttpServer } from "node:http"; L6: import { createServer as createHttpsServer } from "node:https"; ... L36: const __filename = fileURLToPath(import.meta.url); L37: const __dirname = path.dirname(__filename); L38: const workspaceRoot = path.resolve(__dirname, ".."); ... L463: try { L464: const packageJsonPath = path.join(workspaceRoot, "package.json"); L465: const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8")); L466: return cleanText(parsed?.version ?? "") || "0.0.0";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

scripts/viveworker-bridge.mjsView on unpkg · L2

2L3: import { spawn } from "node:child_process"; L4: import crypto from "node:crypto"; L5: import { createServer as createHttpServer } from "node:http"; L6: import { createServer as createHttpsServer } from "node:https"; ... L36: const __filename = fileURLToPath(import.meta.url); L37: const __dirname = path.dirname(__filename); L38: const workspaceRoot = path.resolve(__dirname, ".."); ... L463: try { L464: const packageJsonPath = path.join(workspaceRoot, "package.json"); L465: const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8")); L466: return cleanText(parsed?.version ?? "") || "0.0.0";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/viveworker-bridge.mjsView on unpkg · L2

scripts/viveworker.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3import crypto from "node:crypto";

4import { spawn } from "node:child_process";

5import { promises as fs } from "node:fs";

6import { createServer as createHttpServer } from "node:http";

scripts/moltbook-scout-auto.shView file

•path = scripts/moltbook-scout-auto.sh kind = build_helper sizeBytes = 24876 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/moltbook-scout-auto.shView on unpkg

Source & flagged code

4 flagged · loading source

scripts/viveworker-bridge.mjsView file

2L3: import { spawn } from "node:child_process"; L4: import crypto from "node:crypto"; L5: import { createServer as createHttpServer } from "node:http"; L6: import { createServer as createHttpsServer } from "node:https"; ... L36: const __filename = fileURLToPath(import.meta.url); L37: const __dirname = path.dirname(__filename); L38: const workspaceRoot = path.resolve(__dirname, ".."); ... L463: try { L464: const packageJsonPath = path.join(workspaceRoot, "package.json"); L465: const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8")); L466: return cleanText(parsed?.version ?? "") || "0.0.0";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

scripts/viveworker-bridge.mjsView on unpkg · L2

2L3: import { spawn } from "node:child_process"; L4: import crypto from "node:crypto"; L5: import { createServer as createHttpServer } from "node:http"; L6: import { createServer as createHttpsServer } from "node:https"; ... L36: const __filename = fileURLToPath(import.meta.url); L37: const __dirname = path.dirname(__filename); L38: const workspaceRoot = path.resolve(__dirname, ".."); ... L463: try { L464: const packageJsonPath = path.join(workspaceRoot, "package.json"); L465: const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8")); L466: return cleanText(parsed?.version ?? "") || "0.0.0";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/viveworker-bridge.mjsView on unpkg · L2

scripts/viveworker.mjsView file

3import crypto from "node:crypto"; L4: import { spawn } from "node:child_process"; L5: import { promises as fs } from "node:fs"; L6: import { createServer as createHttpServer } from "node:http"; L7: import os from "node:os"; ... L15: const __filename = fileURLToPath(import.meta.url); L16: const __dirname = path.dirname(__filename); L17: const packageRoot = path.resolve(__dirname, ".."); ... L93: } catch (error) { L94: if (process.stdout.isTTY) { L95: process.stdout.write("\n"); L96: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/viveworker.mjsView on unpkg · L3

scripts/moltbook-scout-auto.shView file

•path = scripts/moltbook-scout-auto.sh kind = build_helper sizeBytes = 24876 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/moltbook-scout-auto.shView on unpkg

Findings

1 Critical5 Medium4 Low

CriticalCredential Exfiltrationscripts/viveworker-bridge.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/viveworker.mjs

MediumShips Build Helperscripts/moltbook-scout-auto.sh

MediumStructural Risk Force Deep Review

LowWeak Cryptoscripts/viveworker-bridge.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings