bolthub

What was found

The package manifest exposes one or more command-line entry points.

Why it matters

Command-line entry points indicate code intended to execute on the user's system.

Evidence snippet

No public snippet is available. It was not recorded or is withheld to protect sensitive content.

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Inspect the declared command-line entry point and its startup behavior, requested permissions and inputs before running it.

Limitations and legitimate-use context

Declaring a command-line tool is common and does not by itself indicate unsafe behavior.

What was found

The package declares a lifecycle script associated with preparation or publication.

Why it matters

Such scripts show automated code execution in the package workflow and provide useful review context.

Evidence snippet

prepublishOnly: bun run build

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Check which preparation or publication workflow invokes the script and distinguish it from consumer installation.

Limitations and legitimate-use context

Publish-oriented scripts do not normally run when a consumer installs the package.

What was found

Static analysis detected a long Base64-like string in source.

Why it matters

Large encoded blobs can hide executable logic, payloads, or embedded data that deserve inspection.

Evidence snippet

"AgEHYm9sdGh1YgJFeyJ2IjoxLCJraWQiOiIwNjZlYTZmNCIsInRpZCI6IjhlNDU5NzMxLTgwYWYtNGI4Mi1hODFkLTYyMjJlYjJjOTEyZSJ9AAJNcGF5bWVudF9oYXNoPTUxYjAxOWZkOWZkMTM5OTk1OWIzYWVkODI1NDlmMGZiYjFjN2E5Zjc5NmM5MGFjOWUwYzFiNmQwMmY2NzgyMjMAAi50ZW5hbnRfaWQ9OGU0NTk3MzEtODBhZi00YjgyLWE4MWQtNjIyMmViMmM5MTJlAAIwZW5kcG9pbnRfaWQ9ZWFjODZjMzYtYTgxOC00ODIyLTg2YzYtNDE0NDc3YTVmYzk2AAIYZXhwaXJlc19hdD0xNzgyNDc5NTgzMzY2AAAGIIBZfBD3S6tz8Gf4+vfShVH2hwfwB8vRR2swa4N3tAXC";

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Determine whether the encoded content is an expected asset or code. Inspect its purpose without executing a decoded payload.

Limitations and legitimate-use context

Encoded data may be a legitimate asset and static matching does not determine its purpose.