.gitignore

LICENSE

README.md

build_and_test.sh

corpus

0027b5cc95f2294388b6165d11b128b70f035aa7

00af1ae09514d4ff40106d015bebfd88cb564c4d

0186c95ba4ad8bf64a1219c1a3c62cdb0dfb7b8c

03cb75451535c1a21cf4dcf595877831ce79bd31

0464db30f7a0c8c21229ae69da2bbd9ffbe8e5f1

04b46b7ad2d4da47a32119c1d39c814a420cfa57

04da53dc9dcd6d969883e4557fd4aa7ee5645845

072af74633718ce0e173d6b315cf3610a6e6dd5b

076ec05cb9b6796613767d9604e1f39f45f325a7

07bbbacf66f20881ab4064d016df2e5314e66d6e

0872c5b003f0977ac311763cc74267075d16b4bf

0927800f84474dff75259295f999bd40f8fb5f21

09295c961db10bd5218465901dedd401781f620f

09b981d57baa3fc0f0114dee51612b6b2f780f0e

0a0783324ead3fd2b016e60dcfcaef5fb33a260a

0a1b65b36c39df7b98dc498aef501140ec8104c2

0b243eae9b90a5f087dbe5aec4342168122682c4

0b7e2cf20a58348419a4bbf4992b08004da0c71e

0ba666c50cf2232b8fc36713d31d650f7302b224

0caed4d88a7d43149352f4578938af208bcd51bb

0cef1d10062acedf07cb68f09ad825c081a7fa0e

0f0bc91d22151aa19321cd3e41a07d4262cfac75

0f1f4c2f5423d80e443136b140a55173e2620de9

0f840651d77913368a8e18904813ac636ff6b87f

0f8c9aa17676f8b285fceb37b314eb2f4f317362

0f9609b86cae6434661dcb73511805a937ab3bc7

10557d5e46aa60a10c11f3606841e061c7da308c

10f7ba873cee8e259ffc43245286565b94c3a1f3

120af6ab8d5a4c65d7f1339e63befb9c6170ca3f

128820feb9351cb951131c0e53262bf5b03ffaf1

1291bdd0418bb3aeb4fbec35dea1e3ccd69c9f40

1383017793c816c827be0b587251413b5521a6db

13e242833ef68db5b474789a2ac42a1d635e4410

142fbc9f6c8ebb858d2856e88918b236c52c9cb9

145a36bba60ec41075f97d9be7f2b6d260b13ec1

162cf27f584670ac489cf8713e45663a96a8b3dd

164d323a75641d41da7ede12ba0934305e3b01d9

166ae8ad56a0e5cb698a4f6fb01b60e7cafe37ff

173406410aebcd6796763aeb1e609dedd73243eb

178a4903a253984bb7281c3fa7afa470d299df1e

1853382da0a14926b3f9a3eac35432ad8f440b4c

1a5def25aded6215e6bf4acd9efaa250acae4cdc

1bf2d6858b512894e2259b0fe338d7740aba2dd7

1c1bf23db5b8944e208f0d39266d934a6dcdea48

1c1cb404d7a1f902a0094249b336527bc8ae8275

1d9e69604d4ae6cbd795cb6378e25d3e5cdb5228

1e84bb30a75470c69c1d17ebc24ecc4d1d52da6f

1ea7bcab49fddeb9c0b648e6b5c56c988112f3fc

1ef2d2d5112a4e4a514280fa2e3e51486caad9a8

1fa69ca08bb81fa4dfdf5918c30ec7b5b110cad7

21e11f8eccd4666f27315eb945dc73e6a666d944

2209ba25e971656072459121b1113431b66fc40c

2367094fb35ae80f2631b834cc163c842c849428

23c63d34e385388211e185b07a5d4de31489cba4

25b8d7d855a900d9a22cf7d9ac1582ca4cd467d4

260344eab6f984904f9f0902f34a90c008fa6596

262f33c4a67f62412e950bf0f9c4d532a6dfd4aa

26389f743a0d977596bcfd79283e15a5629b3e1f

277950cb0527d9d25f896dcd6603a2af445b948a

27d35624845f4e3792af39534ff6d28f2340f8fc

28470dc2a0f6090e67199af1ec681857f6d9e524

2929a8b0f12ee9c5271b8a0cba2bc94052528aac

292ae71e9a17e110ed18ce1af802381ac797bb72

29cf43a61a3c7c4de6382258a21247dc4d9bd933

29d2c6a00583aa8b6054882458b84bffdaae8bcb

2a4ad03c87ac6ebca7caee71dde890535c91a742

2a5495006b753a9c1dca44e2a3e9d2a7d5f0e7f1

2a966edfc10a9a8c638277f6bdf14a95623e46da

2b46d1b4f5fb38f45d2e2354dba76b985731da0b

2bf02be9be71df8a657b57bd8f5920510a622fb3

2c7fe20dcf030674d04b926e74f9420519eadd7b

2fd1136140c7c696133d7524ad3a5c9d9ca9c15f

2fdcdc043d83a7558f8ca27c065bec8d0c9fb5ff

302100c9e93a30f97fb0162f3b53dd322b959348

30e53fa84c3b86cab53a958aeef7ace6d5fa238a

31e6894e749580a4c391368963e2e071f526d9b3

32096c2e0eff33d844ee6d675407ace18289357d

320b80a8801fddcf0f42dfbca0f1a40cce1f03de

34223858631e4df7e6cb725aba690d6ab872e669

348b8ab143119022e9e5b923cb4a72552a47d1a6

34a643b002bfe95189101164db5aaa7b7039d852

35740b80baef16942379910615aca29fbed96078

359ce6764c6b095789e57f3610406f8b65ad3614

3712ef0c330dc490ab9a62526d265da8a81f9f2f

384ae3ffa3cbd142725a09fc989eb4fe2f680da5

38a92140b48d59a25e469732a58c2f037276b05b

39281c4e47bf96a31e4ced63d8d9165bea902860

398005b6d8ddd0dc427238d6177c24300bf58d2a

398c91ebc25f2103942d98d034b030c3c4ceab0f

39d91dff6d33bd2008aa9b9ef94c720270c7c63c

3a71b8342d1f3a218681e3ea712a6660e4884c46

3b0df260cd9d207a4bbbdee6dd5979d296f2bcc8

3c948f3c49dd8aafcacbcdc85a30b0986396c57b

3c96dc98d33d792b0236814804398059bbff1348

3cbc33847206bbd2735f0c1ac341bcbc286f8406

Announcing our $40M Series B led by Abstract Ventures

github.com/Pyrinpyi/go-muhash

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

github.com/Pyrinpyi/go-muhash - go Package File explorer