@8wave/ai-elements@0.101.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@8wave/ai-elements@0.101.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/_chunks/index.es-B9rhQl9Z.jsView file

165patternName = generic_password severity = medium line = 165

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/_chunks/index.es-B9rhQl9Z.jsView on unpkg · L165

dist-vue/index.jsView file

101title: u(), L102: body: u().nullable(), L103: groupKey: u().nullable(), ... L607: try { L608: let r = a ? JSON.parse(a) : null; L609: i = !0, t.value = r ? Ri(r) : "object", n.value = r ? zi(r) : [], e.value = r, rr(() => { ... L1451: }), r; L1452: }, q = "md-editor", Ja = "MdEditor", Ya = "https://unpkg.com", Xa = `${Ya}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, Za = { L1453: main: `${Ya}/prettier@3.8.1/standalone.js`, ... L2266: if (typeof e == "string") { L2267: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2268: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L101

867cr(async () => { L868: let { CodeEditor: e } = await import("monaco-editor-vue3"); L869: l.value = e;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/index.jsView on unpkg · L867

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"Puoi collegare solo account che usano la stessa email del tuo profilo.\",\"accountLinkError\":\"Impossibile col... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"You can only link accounts that use the same email as your profile.\",\"accountLinkError\":\"Unable to link the...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View on unpkg

dist/_chunks/iconify-BGSTR7vH.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.109.0 matchedPath = dist/_chunks/iconify-CpjEsXoO.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.109.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/_chunks/iconify-BGSTR7vH.jsView on unpkg

dist-vue/_chunks/PkStreamingMarkdown-BBni7OTn.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @8wave/ai-elements@0.106.0 matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.106.0 similarity = 0.725 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-vue/_chunks/PkStreamingMarkdown-BBni7OTn.jsView on unpkg

dist-vue/_chunks/index.es-BT6Jr2yi.jsView file

278patternName = generic_password severity = medium line = 278

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/index.es-BT6Jr2yi.js

dist-vue/_chunks/index.es-BT6Jr2yi.jsView on unpkg · L278

dist-vue/_chunks/PkChatbotViewChat-CBvcSg0J.jsView file

7287patternName = generic_password severity = medium line = 7287

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/PkChatbotViewChat-CBvcSg0J.js

dist-vue/_chunks/PkChatbotViewChat-CBvcSg0J.jsView on unpkg · L7287

dist-vue/locales.jsView file

253patternName = generic_password severity = medium line = 253

Medium

Secret Pattern

Hardcoded password in dist-vue/locales.js

dist-vue/locales.jsView on unpkg · L253

788patternName = generic_password severity = medium line = 788

Medium

Secret Pattern

Hardcoded password in dist-vue/locales.js

dist-vue/locales.jsView on unpkg · L788

Source & flagged code

11 flagged

dist/_chunks/index.es-B9rhQl9Z.jsView file

Lines 145-185javascript

145 }

146 flatten(e = (e) => e.message) {

147 let t = Object.create(null), n = [];

148 for (let r of this.issues) if (r.path.length > 0) {

149 let n = r.path[0];

150 t[n] = t[n] || [], t[n].push(e(r));

151 } else n.push(e(r));

152 return {

153 formErrors: n,

154 fieldErrors: t

155 };

156 }

157 get formErrors() {

158 return this.flatten();

159 }

160};

161//#endregion

162//#region ../../node_modules/.pnpm/@volverjs+form-vue@1.1.5_@volverjs+ui-vue@0.0.17_@json-render+core@0.19.0_zod@4.4.3__@v_2448f87425c7b603bbbe2abd82dabb7a/node_modules/@volverjs/form-vue/dist/index.es.js

163R.create = (e) => new R(e), m(), u(), v();

164var z = /* @__PURE__ */ function(e) {

165 return e.text = "text", e.number = "number", e.email = "email", e.password = "password", e.tel = "tel", e.url = "url", e.search = "search", e.date = "date", e.time

166}({}), B = /* @__PURE__ */ function(e) {

167 return e.invalid = "invalid", e.valid = "valid", e.submitting = "submitting", e.reset = "reset", e.updated = "updated", e.unknown = "unknown", e;

168}({}), V = (e) => e._def.typeName === "ZodObject", H = (e) => e._zod.def.type === "object", ee = (e) => e._def.typeName ===

169function q(e) {

170 let t = e;

171 for (; W(t);) t = t.innerType();

172 return t;

173}

174function J(e) {

175 let t = e;

176 for (; se(t);) t = ce(t._zod.def.out) ? t._zod.def.in : t._zod.def.out;

177 return t;

178}

179var le = (e) => {

180 let t = q(e);

181 return G(t) && (t = t._def.innerType), t;

182}, ue = (e) => {

183 let t = J(e);

184 return K(t) && (t = t._zod.def.innerType), t;

185}, de = (e) => !!G(q(e)), fe = (e) => !!K(J(e)), Y = (e) => "_zod"

Long lines were clipped for display.

dist-vue/index.jsView file

101title: u(), L102: body: u().nullable(), L103: groupKey: u().nullable(), ... L607: try { L608: let r = a ? JSON.parse(a) : null; L609: i = !0, t.value = r ? Ri(r) : "object", n.value = r ? zi(r) : [], e.value = r, rr(() => { ... L1451: }), r; L1452: }, q = "md-editor", Ja = "MdEditor", Ya = "https://unpkg.com", Xa = `${Ya}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, Za = { L1453: main: `${Ya}/prettier@3.8.1/standalone.js`, ... L2266: if (typeof e == "string") { L2267: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2268: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L101

867cr(async () => { L868: let { CodeEditor: e } = await import("monaco-editor-vue3"); L869: l.value = e;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/index.jsView on unpkg · L867

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"Puoi collegare solo account che usano la stessa email del tuo profilo.\",\"accountLinkError\":\"Impossibile col... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"You can only link accounts that use the same email as your profile.\",\"accountLinkError\":\"Unable to link the...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View on unpkg

dist/_chunks/iconify-BGSTR7vH.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.109.0 matchedPath = dist/_chunks/iconify-CpjEsXoO.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.109.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/_chunks/iconify-BGSTR7vH.jsView on unpkg

dist-vue/_chunks/PkStreamingMarkdown-BBni7OTn.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @8wave/ai-elements@0.106.0 matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.106.0 similarity = 0.725 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-vue/_chunks/PkStreamingMarkdown-BBni7OTn.jsView on unpkg

dist-vue/_chunks/index.es-BT6Jr2yi.jsView file

Lines 258-298javascript

258 if (i.length === 0) return e;

259 for (let t = 0; t < i.length; t++) {

dist-vue/_chunks/PkChatbotViewChat-CBvcSg0J.jsView file

7287patternName = generic_password severity = medium line = 7287

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/PkChatbotViewChat-CBvcSg0J.js

dist-vue/_chunks/PkChatbotViewChat-CBvcSg0J.jsView on unpkg · L7287

dist-vue/locales.jsView file

Lines 233-273javascript

233 loadDelay: "Load Delay (ms)",

234 loaderStrategy: "Loader Strategy",

235 loaderStrategyInlineModule: "Inline Module",

236 loaderStrategyScriptSrc: "Script Src",

237 loaderStrategyDynamicImport