74/ 100
CautionPartial runCaution: The build did not complete, so install-time and runtime behaviour were not observed. Scanned 23 Oct 2026.
Build failed (the build downloaded https://electronjs.org/headers/v43.8.3/node-v43.8.3-headers.tar.gz, and the sandbox forge answers electronjs.org with a stand-in, so the download was not usable), so the program never ran
How the attack works
as the sandbox saw itScore
100 − 16 = 74Points taken off
−16What it did
306 events in 56.2sNetwork
nothing real left the machineShow all 201 calls
Luna's report
Caution: read the flagged code first. The build did not complete, so install-time and runtime behaviour were not observed. The key limitation is that the install phase did not complete.
We fetched the repository, checked its contents, and scanned the code involved in installation and the entry point. The build tried to download Electron headers, but the sandbox supplied a stand-in, so the build failed and the program did not run.
What it ran
Jev's answers
answered from the evidenceShow all 3 answers
Show all 7 answers
package.jsonbuild/lib/download.tsbuild/lib/electronVersion.tsNot verified
Behaviour outside the observed install and entry windows
Code paths not triggered by install or the entry point
Show all 11 items
Payloads gated on calendar dates past the accelerated clock window, or on hosts that need real responses
Flagged code that was read but never seen doing anything in the sandbox, so it takes no points: 7 reachable finding location(s). (-5: Code reads the npm login token file at build/lib/electronVersion.ts:12 (install); -5: Code reads the npm login token file at build/npm/installStateHash.ts:21 (install); -5: Code reads the npm login token file at build/npm/postinstall.ts:16 (install))
Blocked downloads: 1 plain request to electronjs.org sent nothing and was answered by the sandbox, so nothing arrived or ran; what the real hosts would have returned was not checked
Install phase did not complete (failed), so later behaviour was not observed
Entry phase was skipped, so its behaviour was not observed
Dev dependencies: install scripts run (3 packages), other code not executed (1148 packages)
fsevents 2.3.2: macOS-only, not run in this sandbox
fsevents 1.2.13: macOS-only, not run in this sandbox
Key-shaped strings in 9 files, never seen leaving the machine
Reputation
Shown apart from the code and behaviour findings.