registry  /  whatap  /  2.0.6

whatap@2.0.6

Monitoring and Profiling Service

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 129 file(s), 833 KB of source, external domains: 169.254.169.254

Source & flagged code

5 flagged · loading source
index.jsView file
6L7: exports.NodeAgent = require('./lib/core/agent').NodeAgent; L8: exports.Tracer = require('./lib/trace/trace-context-manager');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6
lib/core/agent.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = whatap@2.0.4 matchedIdentity = npm:d2hhdGFw:2.0.4 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core/agent.jsView on unpkg
9path = require('path'), L10: child_process = require('child_process'), L11: properLock = require('proper-lockfile'), ... L24: SocketioObserver = require('../observers/socket.io-observer').SocketIOObserver, L25: WebsocketObserver = require('../observers/websocket-observer').WebsocketObserver, L26: // WsObserver = require('../observers/websocket-observer').WsObserver, ... L91: var self = this; L92: var root = process.cwd(); L93: while(root && root.length >= 1) { L94: var dir_name = path.join(root, 'package.json'); L95: if(fs.existsSync(dir_name)) { ... L123: pid = parseInt(pid);
Low
Weak Crypto

Package source references weak cryptographic algorithms.

lib/core/agent.jsView on unpkg · L9
lib/conf/config-default.jsView file
8function num(k, defValue){ L9: var v=process.env[k]; L10: return v?Number(v):defValue; ... L79: "hook_method_access_protected_enabled": true, L80: "hook_method_access_private_enabled": false, L81: "hook_method_access_none_enabled": true, ... L262: "cloud_platform_chk":str('cloud_platform_chk', 'kr-central-1'), L263: "cloud_platform_httpc":str('cloud_platform_httpc', 'http://169.254.169.254/latest/meta-data/placement/availability-zone'), L264:
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/conf/config-default.jsView on unpkg · L8
agent/linux/amd64/whatap_nodejsView file
•path = agent/linux/amd64/whatap_nodejs kind = native_binary sizeBytes = 21586496 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

agent/linux/amd64/whatap_nodejsView on unpkg

Findings

2 High5 Medium5 Low
HighCloud Metadata Accesslib/conf/config-default.js
HighPrevious Version Dangerous Deltalib/core/agent.js
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryagent/linux/amd64/whatap_nodejs
MediumStructural Risk Force Deep Review
LowWeak Cryptolib/core/agent.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License