@syngrisi/syngrisi

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/syngrisi/syngrisi/blob/8399aedee1cf7a73fa4ca4a3cb38f303f1593004/src/server/utils/__tests__/safeJoinWithin.test.ts#L18 16 | test('rejects a parent-traversal entry name', () => { 17 | assert.equal(safeJoinWithin(dest, '../evil'), null); > 18 | assert.equal(safeJoinWithin(dest, '../../../../etc/passwd'), null); 19 | }); 20 |

HTTP request to raw IP address — legitimate packages use domain names Source: https://github.com/syngrisi/syngrisi/blob/8399aedee1cf7a73fa4ca4a3cb38f303f1593004/src/server/utils/__tests__/validateWebhookUrl.test.ts#L6 4 | 5 | test('accepts a public https URL (IP literal, no DNS lookup)', async () => { > 6 | const parsed = await validateWebhookUrl('https://93.184.216.34/hook', { ssrfProtection: true }); 7 | assert.equal(parsed.hostname, '93.184.216.34'); 8 | });

HTTP request to raw IP address — legitimate packages use domain names Source: https://github.com/syngrisi/syngrisi/blob/8399aedee1cf7a73fa4ca4a3cb38f303f1593004/src/server/utils/__tests__/validateWebhookUrl.test.ts#L11 9 | 10 | test('rejects loopback IPv4 literal', async () => { > 11 | await assert.rejects(() => validateWebhookUrl('https://127.0.0.1/x', { ssrfProtection: true })); 12 | }); 13 |

HTTP request to raw IP address — legitimate packages use domain names Source: https://github.com/syngrisi/syngrisi/blob/8399aedee1cf7a73fa4ca4a3cb38f303f1593004/src/server/utils/__tests__/validateWebhookUrl.test.ts#L15 13 | 14 | test('rejects RFC-1918 private IPv4 literal (10.0.0.0/8)', async () => { > 15 | await assert.rejects(() => validateWebhookUrl('https://10.0.0.5/x', { ssrfProtection: true })); 16 | }); 17 |

HTTP request to raw IP address — legitimate packages use domain names Source: https://github.com/syngrisi/syngrisi/blob/8399aedee1cf7a73fa4ca4a3cb38f303f1593004/src/server/utils/__tests__/validateWebhookUrl.test.ts#L19 17 | 18 | test('rejects RFC-1918 private IPv4 literal (192.168.0.0/16)', async () => { > 19 | await assert.rejects(() => validateWebhookUrl('https://192.168.1.10/x', { ssrfProtection: true })); 20 | }); 21 |

HTTP request to raw IP address — legitimate packages use domain names Source: https://github.com/syngrisi/syngrisi/blob/8399aedee1cf7a73fa4ca4a3cb38f303f1593004/src/server/utils/__tests__/validateWebhookUrl.test.ts#L23 21 | 22 | test('rejects link-local IPv4 literal, incl. cloud metadata address', async () => { > 23 | await assert.rejects(() => validateWebhookUrl('https://169.254.169.254/latest/meta-data', { ssrfProtection: true })) 24 | }); 25 |

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/syngrisi/syngrisi/blob/8399aedee1cf7a73fa4ca4a3cb38f303f1593004/src/server/utils/__tests__/validateWebhookUrl.test.ts#L35 33 | 34 | test('rejects non-http(s) scheme (file:)', async () => { > 35 | await assert.rejects(() => validateWebhookUrl('file:///etc/passwd', { ssrfProtection: true })); 36 | }); 37 |

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.