registry / xypriss / 9.12.5

xypriss@9.12.5

⚠ Under review

XyPriss is a high-performance, TypeScript-first hyper-system web framework powered by a native Go core (XHSC), featuring robust multi-tenant sandboxing, secure native file streaming, and zero Express dependencies.

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 10 file(s), 2.51 MB of source, external domains: 127.0.0.1, api.nehonix.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, dll.nehonix.com, fonts.googleapis.com, fonts.gstatic.com, github.com, lab.nehonix.com, xypriss.nehonix.com

Source & flagged code

10 flagged

package.jsonView file

Lines 19-59json

19 "require": "./dist/cjs/src/index.js",

20 "types": "./dist/index.d.ts"

21 }

22 },

23 "files": [

24 "dist/",

25 "shared/",

26 "scripts/",

27 "README.md",

28 "LICENSE",

29 "CONTRIBUTING.md"

30 ],

31 "scripts": {

32 "XCIS:bench.all": "bash bench/xcis-bench/scripts/bench_all.sh",

33 "XCIS:bench.xstatic": "bash simulations/XCIS/bench_static.sh",

34 "benchmark": "node benchmarks/index.js",

35 "build": "NODE_OPTIONS='--max-old-space-size=4096' xfpm exec rollup -c rollup.config.js",

36 "build:memory": "NODE_OPTIONS='--max-old-space-size=6144' xfpm exec rollup -c rollup.config.js",

37 "install-memory-cli": "node scripts/install-memory-cli.js",

38 "install-xhsc": "node scripts/postinstall-xhsc.js",

39 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "prepublishOnly": "xfpm run build",

41 "test": "jest",

42 "test:coverage": "jest --coverage",

43 "test:watch": "jest --watch"

44 },

45 "dependencies": {

46 "ioredis": "^5.10.0",

47 "nehoid": "^2.2.1",

48 "redis": "^5.11.0",

49 "reliant-type": "^2.1.5",

50 "strulink": "^1.3.0",

51 "xss": "^1.0.15",

52 "xypriss-compression": "^1.0.6"

53 },

54 "devDependencies": {

55 "@rollup/plugin-commonjs": "^25.0.8",

56 "@rollup/plugin-json": "^6.1.0",

57 "@rollup/plugin-node-resolve": "^15.3.1",

58 "@rollup/plugin-terser": "^1.0.0",

59 "@rollup/plugin-typescript": "^11.1.6",

•name = xypriss; similarTo = cypress

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/esm/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = xypriss@9.12.4 matchedIdentity = npm:eHlwcmlzcw:9.12.4 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/esm/index.jsView on unpkg

7import crypto__default, { timingSafeEqual } from 'crypto'; L8: import { execFileSync, spawn } from 'node:child_process'; L9: import * as fs from 'node:fs'; ... L11: import { fileURLToPath } from 'node:url'; L12: import * as net from 'node:net'; L13: import * as fs$1 from 'fs'; ... L344: */ L345: const canColor = () => typeof process === "undefined" || !("NO_COLOR" in process.env); L346: // ───────────────────────────────────────────── ... L821: catch { L822: process?.stderr?.write(`[LOGGER_FAILURE] ${message}\n`); L823: }

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/esm/index.jsView on unpkg · L7

129function getSysApi() { L130: return require("../../xhsc").localSysApi; L131: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/index.jsView on unpkg · L129

scripts/monitor_memory.shView file

•path = scripts/monitor_memory.sh kind = build_helper sizeBytes = 3955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/monitor_memory.shView on unpkg

dist/index.d.tsView file

Lines 599-639typescript

599 /** Security settings for cache */

600 security?: CacheSecurityConfig;

601 /** Monitoring and metrics configuration */

602 monitoring?: CacheMonitoringConfig;

603 /** Resilience and fault tolerance settings */

604 resilience?: CacheResilienceConfig;

605}

606/**

607 * Redis cache configuration.

608 *

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•name = xypriss; similarTo = cypress

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/esm/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/esm/index.jsView on unpkg

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/esm/index.jsView on unpkg · L7

129function getSysApi() { L130: return require("../../xhsc").localSysApi; L131: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/index.jsView on unpkg · L129

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/esm/index.jsView on unpkg · L7

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/esm/index.jsView on unpkg · L7

scripts/monitor_memory.shView file

•path = scripts/monitor_memory.sh kind = build_helper sizeBytes = 3955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/monitor_memory.shView on unpkg

dist/index.d.tsView file

619patternName = generic_password severity = medium line = 619 matchedText = * pass...rd',

Medium

Secret Pattern

Hardcoded password in dist/index.d.ts

dist/index.d.tsView on unpkg · L619

Findings

1 Critical2 High10 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/esm/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighObfuscated Payload Loaderdist/esm/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumTyposquat Namepackage.json

MediumDynamic Requiredist/esm/index.js

MediumUnsafe Vm Contextdist/esm/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/esm/index.js

MediumShips Build Helperscripts/monitor_memory.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.d.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

10 flagged

package.jsonView file

Lines 19-59json

19 "require": "./dist/cjs/src/index.js",

20 "types": "./dist/index.d.ts"

21 }

22 },

23 "files": [

24 "dist/",

25 "shared/",

26 "scripts/",

27 "README.md",

28 "LICENSE",

29 "CONTRIBUTING.md"

30 ],

31 "scripts": {

32 "XCIS:bench.all": "bash bench/xcis-bench/scripts/bench_all.sh",

33 "XCIS:bench.xstatic": "bash simulations/XCIS/bench_static.sh",

34 "benchmark": "node benchmarks/index.js",

35 "build": "NODE_OPTIONS='--max-old-space-size=4096' xfpm exec rollup -c rollup.config.js",

36 "build:memory": "NODE_OPTIONS='--max-old-space-size=6144' xfpm exec rollup -c rollup.config.js",

37 "install-memory-cli": "node scripts/install-memory-cli.js",

38 "install-xhsc": "node scripts/postinstall-xhsc.js",

39 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "prepublishOnly": "xfpm run build",

41 "test": "jest",

42 "test:coverage": "jest --coverage",

43 "test:watch": "jest --watch"

44 },

45 "dependencies": {

46 "ioredis": "^5.10.0",

47 "nehoid": "^2.2.1",

48 "redis": "^5.11.0",

49 "reliant-type": "^2.1.5",

50 "strulink": "^1.3.0",

51 "xss": "^1.0.15",

52 "xypriss-compression": "^1.0.6"

53 },

54 "devDependencies": {

55 "@rollup/plugin-commonjs": "^25.0.8",

56 "@rollup/plugin-json": "^6.1.0",

57 "@rollup/plugin-node-resolve": "^15.3.1",

58 "@rollup/plugin-terser": "^1.0.0",

59 "@rollup/plugin-typescript": "^11.1.6",

•name = xypriss; similarTo = cypress

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/esm/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/esm/index.jsView on unpkg

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/esm/index.jsView on unpkg · L7

129function getSysApi() { L130: return require("../../xhsc").localSysApi; L131: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/index.jsView on unpkg · L129

scripts/monitor_memory.shView file

•path = scripts/monitor_memory.sh kind = build_helper sizeBytes = 3955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/monitor_memory.shView on unpkg

dist/index.d.tsView file

Lines 599-639typescript

599 /** Security settings for cache */

600 security?: CacheSecurityConfig;

601 /** Monitoring and metrics configuration */

602 monitoring?: CacheMonitoringConfig;

603 /** Resilience and fault tolerance settings */

604 resilience?: CacheResilienceConfig;

605}

606/**

607 * Redis cache configuration.

608 *