registry / zj-plugin-intelligent / 1.2.5

zj-plugin-intelligent@1.2.5

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEval

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.77 MB of source, external domains: ai-api.qiguanbang.com, github.com, qiguanbang.obs.cn-east-3.myhuaweicloud.com, www.w3.org

Source & flagged code

5 flagged

.env.productionView file

Lines 1-3text

1VUE_APP_BASE_API=https://ai-api.qiguanbang.com

2VUE_APP_BASE_AK=gk_147806632ff941c4a381361aa8486e77

3VUE_APP_BASE_SK=aa3920acfdfa43169f0f7dd5379be1ea5d72b71a8d5543fd9e9154b582acc12d

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.productionView on unpkg · L2

lib/ZjPluginIntelligent.common.jsView file

52/*! ieee754. BSD-3-Clause License. Feross Aboukhadijeh <https://feross.org/opensource> */ L53: e.read=function(A,e,t,r,n){var o,i,s=8*n-r-1,a=(1<<s)-1,c=a>>1,u=-7,l=t?n-1:0,f=t?-1:1,h=A[e+l];for(l+=f,o=h&(1<<-u)-1,h>>=-u,u+=s;u>0;o=256*o+A[e+l],l+=f,u-=8);for(i=o&(1<<-u)-1,o... L54: /*!

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/ZjPluginIntelligent.common.jsView on unpkg · L52

lib/.gzView file

•path = lib/.gz kind = high_entropy_blob sizeBytes = 196819 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/.gzView on unpkg

•path = lib/.gz kind = payload_in_excluded_dir sizeBytes = 196819 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

lib/.gzView on unpkg

•path = lib/.gz kind = compressed_blob sizeBytes = 196819 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/.gzView on unpkg

Source & flagged code

5 flagged · loading source

.env.productionView file

2patternName = blocked_file severity = critical matchedText = .env.production redactedSecretContext = secretLikeLines = 2 L2: VUE_APP_BASE_AK=<redacted:35 token-like> L3: VUE_APP_BASE_SK=<redacted:64 hex>

zj-plugin-intelligent@1.2.5

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code