Static Scan Results
scanned 6d ago · by rust-scannerStatic analysis flagged 25 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
17 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli/hooks/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Runtime dependency names matching Node built-ins: fs
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkg•scripts.postinstall = node cli/hooks/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/app/.next-cli-build/server/chunks/42.jsView file
1patternName = private_key_rsa
severity = critical
line = 1
matchedText = "use str...}}};
Critical
Critical Secret
Package contains a critical-looking secret pattern.
cli/app/.next-cli-build/server/chunks/42.jsView on unpkg · L11patternName = private_key_rsa
severity = critical
line = 1
matchedText = "use str...}}};
Critical
Secret Pattern
RSA private key in cli/app/.next-cli-build/server/chunks/42.js
cli/app/.next-cli-build/server/chunks/42.jsView on unpkg · L1open-sse/handlers/ttsProviders/localDevice.jsView file
1// Local device TTS — macOS `say` + Windows SAPI + ffmpeg
L2: import { execFile } from "node:child_process";
L3: import { promisify } from "node:util";
High
Child Process
Package source references child process execution.
open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L135const { stdout } = await execFileAsync(
L36: "powershell.exe",
L37: ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", script],
High
Shell
Package source references shell execution.
open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L35open-sse/translator/index.jsView file
32// Request translators - sync require pattern for bundler
L33: require("./request/claude-to-openai.js");
L34: require("./request/openai-to-claude.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
open-sse/translator/index.jsView on unpkg · L32src/mitm/cert/install.jsView file
2const crypto = require("crypto");
L3: const { exec } = require("child_process");
L4: const { execWithPassword, isSudoAvailable } = require("../dns/dnsConfig.js");
...
L7:
L8: const IS_WIN = process.platform === "win32";
L9: const IS_MAC = process.platform === "darwin";
...
L34: const pem = fs.readFileSync(certPath, "utf-8");
L35: const der = Buffer.from(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, ""), "base64");
L36: return crypto.createHash("sha1").update(der).digest("hex").toUpperCase().match(/.{2}/g).join(":");
...
L52: // Verify exact cert bytes match — same CN with different fingerprint = stale cert
L53: exec(`security find-certificate -a -c "${ROOT_CA_CN}" -Z /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (error, stdout) => {
L54: if (error || !stdout) return resolve(false);
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/mitm/cert/install.jsView on unpkg · L2cli/src/cli/tray/autostart.jsView file
3const os = require("os");
L4: const { execSync } = require("child_process");
L5:
...
L36: }
L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js");
L38: if (fs.existsSync(computed)) return computed;
...
L47: function enableAutoStart(cliPath) {
L48: const platform = process.platform;
L49:
L50: if (!["darwin", "win32", "linux"].includes(platform)) return false;
L51: if (platform === "linux" && !process.env.DISPLAY) return false;
L52:
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
cli/src/cli/tray/autostart.jsView on unpkg · L3cli/app/src/mitm/server.jsView file
24Private-MAC: `+B.digest().toHex()+`\r
L25: `,s};ma.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return vr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};ma.private...
L26: `);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ea(`[SSE in] ${y.slice(0,200...
...
L32: `)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function ko(e){let t=42949672...
L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolU...
L34: $proc = Start-Process powershell -ArgumentList @(
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
cli/app/src/mitm/server.jsView on unpkg · L2424Private-MAC: `+B.digest().toHex()+`\r
L25: `,s};ma.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return vr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};ma.private...
L26: `);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ea(`[SSE in] ${y.slice(0,200...
...
L32: `)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function ko(e){let t=42949672...
L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolU...
L34: $proc = Start-Process powershell -ArgumentList @(
...
L37: ) -Verb RunAs -Wait -PassThru -WindowStyle Hidden;
L38: if ($proc.ExitCode -ne 0) { throw "Elevated command exited with code $($proc.ExitCode)" }
L39: `;return new Promise((r,n)=>{qo(`powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ${zo(a)}`,{windowsHide:!0},(s,i,o)=>{if(s){let u=o||s.message;u.includes("ca..
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
cli/app/src/mitm/server.jsView on unpkg · L24cli/cli.jsView file
2Cross-file remote execution chain: cli/cli.js spawns cli/app/src/mitm/server.js; helper contains network access plus dynamic code execution.
L2:
L3: const { spawn, exec, execSync } = require("child_process");
L4: const path = require("path");
L5: const fs = require("fs");
L6: const https = require("https");
L7: const os = require("os");
...
L16: start() {
L17: if (process.stdout.isTTY) {
L18: process.stdout.write(`\r${frames[0]} ${currentText}`);
L19: interval = setInterval(() => {
...
L44:
L45: const pkg = require("./package.json");
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
cli/cli.jsView on unpkg · L2cli/app/src/lib/updater/updater.jsView file
1// Standalone detached updater process.
L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server.
L3: // Survives after parent Next server exits (detached + unref by spawner).
L4:
L5: const { spawn } = require("child_process");
L6: const http = require("http");
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
cli/app/src/lib/updater/updater.jsView on unpkg · L1cli/src/cli/tray/tray.ps1View file
•path = cli/src/cli/tray/tray.ps1
kind = build_helper
sizeBytes = 2581
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
cli/src/cli/tray/tray.ps1View on unpkgcli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View file
•path = cli/app/.next-cli-[redacted]-s.woff2
kind = high_entropy_blob
sizeBytes = 25844
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View on unpkgcli/app/.next-cli-build/server/chunks/8971.jsView file
1patternName = private_key_rsa
severity = critical
line = 1
matchedText = "use str...}}};
Critical
Secret Pattern
RSA private key in cli/app/.next-cli-build/server/chunks/8971.js
cli/app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1Findings
3 Critical9 High7 Medium6 Low
CriticalCritical Secretcli/app/.next-cli-build/server/chunks/42.js
CriticalSecret Patterncli/app/.next-cli-build/server/chunks/42.js
CriticalSecret Patterncli/app/.next-cli-build/server/chunks/8971.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processopen-sse/handlers/ttsProviders/localDevice.js
HighShellopen-sse/handlers/ttsProviders/localDevice.js
HighSame File Env Network Executioncli/app/src/mitm/server.js
HighCommand Output Exfiltrationcli/app/src/mitm/server.js
HighCross File Remote Execution Contextcli/cli.js
HighRuntime Package Installcli/app/src/lib/updater/updater.js
HighShips High Entropy Blobcli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2
HighNode Builtin Dependency Squatpackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireopen-sse/translator/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencecli/src/cli/tray/autostart.js
MediumShips Build Helpercli/src/cli/tray/tray.ps1
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/mitm/cert/install.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings