web-js-env-patcher
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/download_ruyi_tool.jsfetches release metadata and binary assets from GitHub repositoriesLoseNine/Firefox-FingerPrint-AnalyzerandLoseNine/ruyipageto install forensics tooling. - [REMOTE_CODE_EXECUTION]: The utility
scripts/load_native_addon.jsdynamically identifies and loads platform-specific native Node.js addons (.nodefiles) using therequire()function to provide low-level browser API simulations. These binaries were flagged by YARA as embedded PE executables. - [COMMAND_EXECUTION]: Multiple environment scripts, including
scripts/check_external_tools.jsandscripts/check_node_runtime_compat.js, execute system commands such aspython,nvm,where, andwhichto validate dependencies and runtime versions. - [COMMAND_EXECUTION]:
scripts/run_trace_runtime_audit.jsexecutes the user's final project entry point as a child process to capture runtime observations. - [COMMAND_EXECUTION]:
scripts/capture_ruyitrace_log.jsattempts to launch a customized Firefox browser with specific environment variables for tracing purposes.
Audit Metadata