Local static analysis and evidence generation for deployed AI model artifacts
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
- HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
- HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
- HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
- HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
- HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
- HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
transport stdio · http
verified
reported
listed in the official MCP registry counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 3cc4bbc · analyzer v33 · 3h ago
skills & prompt files 1
danger signals2
- dynamic code execution vm exec JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-service-worker-lifecycle.mjs :103
vm.runInNewContext(workerSource, context, { filename: "web/sw.js" }); - dynamic code execution eval() JunHwan-Kwon-deepbom-3cc4bbc/scripts/test-live-permissions.mjs :551
async eval(expression, awaitPromise = false) {
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 811
filesystem 208
- fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-agent-integration.mjs :2
import { lstat, mkdir, readFile, rename, rm, rmdir, writeFile } from "node:fs/promises"; - fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-automation.mjs :2
import { access, mkdir, open, rename, unlink } from "node:fs/promises"; - fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-input.mjs :1
import { lstat, open, readdir } from "node:fs/promises"; - fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-mcp.mjs :1
import { existsSync, realpathSync } from "node:fs"; - fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom.mjs :4
import { access, readFile } from "node:fs/promises"; - fs JunHwan-Kwon-deepbom-3cc4bbc/bin/nvidia-accelerator-collector.mjs :2
import { createReadStream } from "node:fs"; - fs JunHwan-Kwon-deepbom-3cc4bbc/bin/remote-artifact-closure.mjs :2
import { readFile, stat } from "node:fs/promises"; - fs JunHwan-Kwon-deepbom-3cc4bbc/bin/remote-artifact-resolver.mjs :2
import { createReadStream, createWriteStream } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/benchmark-streaming-wasm-candidates.mjs :3
import { mkdir, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/bootstrap-instrumented-runtime.mjs :2
import { createReadStream, createWriteStream } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/browser-launch.mjs :1
import { existsSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-cargo-engine-release.mjs :3
import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
show 28 more
- fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-channel-artifacts.mjs :3
import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-coreml-legacy-quantization-corpus.mjs :1
import { mkdir, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-cyclonedx-generalization-evidence.mjs :2
import { readFile, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-mcpb-bundle.mjs :2
import { readFile, readdir, rm, writeFile, mkdir } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-contract-conflict-corpus.mjs :3
import { readFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-extension-contract-corpus.mjs :2
import { mkdir, readFile, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-pages.mjs :1
import { readFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-public-multiformat-corpus-manifest.mjs :2
import { readFile, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-public-multiformat-residual-sweep.mjs :2
import { readFileSync, writeFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-release.mjs :2
import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-residual-coverage-ledger.mjs :2
import { readFileSync, writeFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-safetensors-quantization-corpus.mjs :2
import { mkdir, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-wasm.mjs :2
import { readFile, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-gguf-runtime.mjs :2
import { createReadStream } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-pinned-runtime.mjs :1
import { access, mkdir, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-tensorrt-engine-inspector.mjs :4
import { readFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-tensorrt-parser.mjs :4
import { readFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-access-hierarchy.mjs :1
import { existsSync, readFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-atlas-viewer.mjs :2
import { mkdtemp, readFile, rm } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-atlas.mjs :1
import { readFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-reachability-viewer.mjs :2
import { mkdtemp, readFile, rm } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-reachability.mjs :1
import { readFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-advanced-copy-contract.mjs :1
import { readFileSync } from "node:fs"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-agent-evaluation.mjs :3
import { readFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-agent-native.mjs :3
import { access, mkdtemp, readFile, rm, writeFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-analysis-invariants.mjs :8
import { readFile } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-artifact-ir-consumers.mjs :1
import { readFile, readdir } from "node:fs/promises"; - fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-artifact-ir-import-boundary.mjs :1
import { readFile, readdir } from "node:fs/promises";
168 more not shown — this panel samples each group; the count above is the real total.
shell / exec 68
- shell JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-agent-skill.mjs :138
'import { spawnSync } from "node:child_process";', - shell JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-mcp.mjs :2
import { spawn } from "node:child_process"; - shell JunHwan-Kwon-deepbom-3cc4bbc/bin/nvidia-accelerator-collector.mjs :5
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/bootstrap-instrumented-runtime.mjs :280
return import("node:child_process").then(({ execFile }) => new Promise((resolve, reject) => { - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-channel-artifacts.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-contract-conflict-corpus.mjs :1
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-release.mjs :1
import { execFileSync, spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-gguf-runtime.mjs :6
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-pinned-runtime.mjs :142
const { spawn } = await import("node:child_process"); - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-agent-evaluation.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-agent-native.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-analysis-summary-contract.mjs :2
import { spawnSync } from "node:child_process";
show 28 more
- shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-artifact-ir.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-cargo-engine-release.mjs :3
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-channel-equivalence.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-cli-automation.mjs :5
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-cli-graph-export.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-cli.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-conversion-receipt.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-expected-output.mjs :2
import { execFileSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-explorer-redesign.mjs :3
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-coreml-correctness.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-defect-gate.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-gguf-correctness.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-onnx-correctness.mjs :3
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-tflite-correctness.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-finding-rule-registry.mjs :3
import { execFileSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-gguf-backend-contract.mjs :1
import { execFileSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-git-privacy.mjs :1
import { execFileSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-ir-stabilization-ui.mjs :1
import { execFileSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-js.mjs :1
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-mcp-inspector.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-mcp-server.mjs :2
import { spawn, spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-mcpb-bundle.mjs :3
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-parser-robustness-isolated.mjs :1
import { spawn } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-private-wasm-build.mjs :1
import { execFileSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-private-wasm-contract.mjs :1
import { execFileSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-public-product-boundary.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-semantic-artifact-diff.mjs :2
import { spawnSync } from "node:child_process"; - shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-sw-version.mjs :1
import { execFileSync } from "node:child_process";
28 more not shown — this panel samples each group; the count above is the real total.
network 73
- net JunHwan-Kwon-deepbom-3cc4bbc/pkg/tflite_wasm_audit.js :1214
module_or_path = fetch(module_or_path); - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/bootstrap-instrumented-runtime.mjs :165
const response = await fetch(source.url, { redirect: "follow" }); - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-contract-conflict-corpus.mjs :34
const response = await fetch(url, { redirect: "follow" }); - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-extension-contract-corpus.mjs :121
const response = await fetch(url, { redirect: "follow", headers: { "User-Agent": "DeepBOM-contract-corpus/1.0" } }); - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-safetensors-quantization-corpus.mjs :70
const response = await fetch(`${base}${configPath}`); - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-atlas-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-reachability-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-bootstrap-retry.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-calibration-validation-viewer.mjs :4
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-channel-vitality-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-contract-migration-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-conversion-receipt.mjs :6
import { createServer } from "node:http";
show 28 more
- net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-core-isolation-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-delegation-repair-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-deployment-delta-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-deployment-frontier-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-dynamic-shape-cost-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-evidence-package-profile-ui.mjs :2
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-execution-placement-viewer.mjs :2
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-explorer-redesign-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-export-contract-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-test-access.mjs :96
const issueResponse = await worker.fetch(new Request("https://deepbom.test/api/admin/test-links", { - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-test-page.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-format-capability-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-format-quant-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-input-counterexample-viewer.mjs :4
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-ir-stabilization-ui.mjs :2
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-kernel-witness-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-live-product.mjs :3
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-live-sw.mjs :49
const response = await fetch(url, { cache: "no-store" }); - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-numerical-abi-propagation-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-on-device-llm-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-onnx-domain-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-ort-native-capture.mjs :3
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-ort-profile-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-preprocessing-consequence-viewer.mjs :4
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-preprocessing-realizability-viewer.mjs :4
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-protected-selector-viewer.mjs :1
import { createServer } from "node:http"; - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-public-samples.mjs :63
const response = await fetch(sample.path); - net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-quant-evidence-chains-viewer.mjs :1
import { createServer } from "node:http";
33 more not shown — this panel samples each group; the count above is the real total.
secrets 1
- secrets (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/huggingface-community-corpus-lib.mjs :291
if (process.env.HF_TOKEN) return String(process.env.HF_TOKEN).trim();
install hooks 1
- postinstall JunHwan-Kwon-deepbom-3cc4bbc/package.json :23
node scripts/patch-litert-int8.mjs && node scripts/write-build-metadata.mjs --auto-distribution
declared dependencies 20
- @litertjs/core@^2.5.2
- onnxruntime-web@^1.26.0
- acorn@^8.15.0
- adm-zip@0.6.0
- ajv@8.20.0
- ajv-draft-04@1.0.0
- ajv-formats@3.0.1
- ajv-formats-draft2019@1.6.1
- es-module-lexer@1.7.0
- esbuild@0.28.1
- onnxruntime-node@1.26.0
- playwright@^1.61.1
show 8 more
- postject@1.0.0-alpha.6
- serde@1
- serde_json@1
- serde-wasm-bindgen@0.6
- sha2@0.10
- wasm-bindgen@0.2
- js-sys@0.3
- miniz_oxide@0.9
obfuscation 3
- dynamic require()/import() JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-dist-assets.mjs :18
const { ANALYZER_BUNDLE_CONTENT_SHA256 } = await import(`${pathToFileURL(path.resolve(distBuildMetadataPath)).href}?dist-asset-check=${Date.now()}`); - dynamic require()/import() JunHwan-Kwon-deepbom-3cc4bbc/web/bootstrap.js :35
: import(`./app.js?bootstrap-retry=${attempt}`); - dynamic require()/import() JunHwan-Kwon-deepbom-3cc4bbc/web/workers/deepbom-analysis-worker.js :16
const module = await import(`${moduleUrl}${moduleUrl.includes("?") ? "&" : "?"}v=${encodeURIComponent(version || "1")}`);