Static Scan Results
scanned 7d ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourceindex.jsView file
6L7: exports.NodeAgent = require('./lib/core/agent').NodeAgent;
L8: exports.Tracer = require('./lib/trace/trace-context-manager');
Medium
lib/core/agent.jsView file
9path = require('path'),
L10: child_process = require('child_process'),
L11: properLock = require('proper-lockfile'),
...
L24: SocketioObserver = require('../observers/socket.io-observer').SocketIOObserver,
L25: WebsocketObserver = require('../observers/websocket-observer').WebsocketObserver,
L26: // WsObserver = require('../observers/websocket-observer').WsObserver,
...
L91: var self = this;
L92: var root = process.cwd();
L93: while(root && root.length >= 1) {
L94: var dir_name = path.join(root, 'package.json');
L95: if(fs.existsSync(dir_name)) {
...
L123: pid = parseInt(pid);
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/core/agent.jsView on unpkg · L9lib/conf/config-default.jsView file
8function num(k, defValue){
L9: var v=process.env[k];
L10: return v?Number(v):defValue;
...
L79: "hook_method_access_protected_enabled": true,
L80: "hook_method_access_private_enabled": false,
L81: "hook_method_access_none_enabled": true,
...
L262: "cloud_platform_chk":str('cloud_platform_chk', 'kr-central-1'),
L263: "cloud_platform_httpc":str('cloud_platform_httpc', 'http://169.254.169.254/latest/meta-data/placement/availability-zone'),
L264:
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
lib/conf/config-default.jsView on unpkg · L8agent/linux/amd64/whatap_nodejsView file
•path = agent/linux/amd64/whatap_nodejs
kind = native_binary
sizeBytes = 21577344
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
agent/linux/amd64/whatap_nodejsView on unpkgFindings
1 High5 Medium5 Low
HighCloud Metadata Accesslib/conf/config-default.js
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryagent/linux/amd64/whatap_nodejs
MediumStructural Risk Force Deep Review
LowWeak Cryptolib/core/agent.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License