@8wave/ai-elements@0.103.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@8wave/ai-elements@0.103.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/_chunks/web-BMnEaWK7.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/_chunks/web-BMnEaWK7.jsView on unpkg · L7027

dist-vue/_chunks/livescript-mG3hs7a-.jsView file

16return e.next(), "error"; L17: }, t = "(?![\\d\\s])[$\\w\\xAA-\\uFFDC](?:(?!\\s)[$\\w\\xAA-\\uFFDC]|-[A-Za-z])*", n = RegExp("(?:[({[=:]|[-~]>|\\b(?:e(?:lse|xport)|d(?:o|efault)|t(?:ry|hen)|finally|import(?:\\s*... L18: token: "string",

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/_chunks/livescript-mG3hs7a-.jsView on unpkg · L16

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"Puoi collegare solo account che usano la stessa email del tuo profilo.\",\"accountLinkError\":\"Impossibile col... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"You can only link accounts that use the same email as your profile.\",\"accountLinkError\":\"Unable to link the...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/index.jsView file

101title: u(), L102: body: u().nullable(), L103: groupKey: u().nullable(), ... L607: try { L608: let r = a ? JSON.parse(a) : null; L609: i = !0, t.value = r ? Ri(r) : "object", n.value = r ? zi(r) : [], e.value = r, rr(() => { ... L1451: }), r; L1452: }, q = "md-editor", Ja = "MdEditor", Ya = "https://unpkg.com", Xa = `${Ya}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, Za = { L1453: main: `${Ya}/prettier@3.8.1/standalone.js`, ... L2266: if (typeof e == "string") { L2267: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2268: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L101

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View on unpkg

dist/_chunks/index.es-BbyodRh9.jsView file

165patternName = generic_password severity = medium line = 165

Medium

Secret Pattern

Hardcoded password in dist/_chunks/index.es-BbyodRh9.js

dist/_chunks/index.es-BbyodRh9.jsView on unpkg · L165

dist-vue/_chunks/web-BMnEaWK7.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/web-BMnEaWK7.js

dist-vue/_chunks/web-BMnEaWK7.jsView on unpkg · L7027

dist-vue/_chunks/index.es-BKxzs6Sh.jsView file

278patternName = generic_password severity = medium line = 278

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/index.es-BKxzs6Sh.js

dist-vue/_chunks/index.es-BKxzs6Sh.jsView on unpkg · L278

dist-vue/locales.jsView file

256patternName = generic_password severity = medium line = 256

Medium

Secret Pattern

Hardcoded password in dist-vue/locales.js

dist-vue/locales.jsView on unpkg · L256

794patternName = generic_password severity = medium line = 794

Medium

Secret Pattern

Hardcoded password in dist-vue/locales.js

dist-vue/locales.jsView on unpkg · L794

Source & flagged code

10 flagged

dist/_chunks/web-BMnEaWK7.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/_chunks/web-BMnEaWK7.jsView on unpkg · L7027

dist-vue/_chunks/livescript-mG3hs7a-.jsView file

Lines 1-36javascript

1//#region ../../node_modules/.pnpm/@codemirror+legacy-modes@6.5.3/node_modules/@codemirror/legacy-modes/mode/livescript.js

2var e = function(e, t) {

3 var n = t.next || "start";

4 if (n) {

5 t.next = t.next;

6 var r = a[n];

7 if (r.splice) {

8 for (var i = 0; i < r.length; ++i) {

9 var o = r[i];

10 if (o.regex && e.match(o.regex)) return t.next = o.next || t.next, o.token;

11 }

12 return e.next(), "error";

13 }

14 if (e.match(o = a[n])) return o.regex && e.match(o.regex) ? (t.next = o.next, o.token) : (e.next(), "error");

15 }

16 return e.next(), "error";

17}, t = "(?![\\d\\s])[$\\w\\xAA-\\uFFDC](?:(?!\\s)[$\\w\\xAA-\\uFFDC]|-[A-Za-z])*", n = RegExp("(?:[({[=:]|[-~]>|\\b(?:e(?:lse|xport)|d(?:o|efault)|t(?:ry|hen)|finally|import(?:\\s*all)?|const|var|let|new|catch(?:\\s*"

18 token: "string",

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/_chunks/livescript-mG3hs7a-.jsView on unpkg · L16

19 regex: ".+"

20}, a = {

21 start: [

22 {

23 token: "docComment",

24 regex: "/\\*",

25 next: "comment"

26 },

27 {

28 token: "comment",

29 regex: "#.*"

30 },

31 {

32 token: "keyword",

33 regex: "(?:t(?:h(?:is|row|en)|ry|ypeof!?)|c(?:on(?:tinue|st)|a(?:se|tch)|lass)|i(?:n(?:stanceof)?|mp(?:ort(?:\\s+all)?|lements)|[fs])|d(?:e(?:fault|lete|bugger)|o)|f(?:or(?:\\s+own)?|inally|unction)|s(?:uper|witch)|e(?:lse|x(?:tends|port)|val)|a(?:nd|rguments)|n(?:ew|ot)|un(?:less|til)|w(?:hile|ith)|o[fr]|return|break|let|var|loop)" + r

34 },

35 {

36 token: "atom",

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"Puoi collegare solo account che usano la stessa email del tuo profilo.\",\"accountLinkError\":\"Impossibile col... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"You can only link accounts that use the same email as your profile.\",\"accountLinkError\":\"Unable to link the...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/index.jsView file

101title: u(), L102: body: u().nullable(), L103: groupKey: u().nullable(), ... L607: try { L608: let r = a ? JSON.parse(a) : null; L609: i = !0, t.value = r ? Ri(r) : "object", n.value = r ? zi(r) : [], e.value = r, rr(() => { ... L1451: }), r; L1452: }, q = "md-editor", Ja = "MdEditor", Ya = "https://unpkg.com", Xa = `${Ya}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, Za = { L1453: main: `${Ya}/prettier@3.8.1/standalone.js`, ... L2266: if (typeof e == "string") { L2267: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2268: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L101

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View on unpkg

dist/_chunks/index.es-BbyodRh9.jsView file

Lines 145-185javascript

145 }

146 flatten(e = (e) => e.message) {

147 let t = Object.create(null), n = [];

148

dist-vue/_chunks/web-BMnEaWK7.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/web-BMnEaWK7.js

dist-vue/_chunks/web-BMnEaWK7.jsView on unpkg · L7027

dist-vue/_chunks/index.es-BKxzs6Sh.jsView file

Lines 258-298javascript

258 if (i.length === 0) return e;

259 for (let t = 0; t < i.length; t++) {

dist-vue/locales.jsView file

Lines 236-276javascript

236 loadDelay: "Load Delay (ms)",

237 loaderStrategy: "Loader Strategy",

238 loaderStrategyInlineModule: "Inline Module",

239 loaderStrategyScriptSrc: "Script Src",

240 loaderStrategyDynamicImport