@8wave/ai-elements@0.106.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@8wave/ai-elements@0.106.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/_chunks/web-Deav1PAL.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/_chunks/web-Deav1PAL.jsView on unpkg · L7027

dist-vue/index.jsView file

102title: u(), L103: body: u().nullable(), L104: groupKey: u().nullable(), ... L608: try { L609: let r = a ? JSON.parse(a) : null; L610: i = !0, t.value = r ? Bi(r) : "object", n.value = r ? Vi(r) : [], e.value = r, ar(() => { ... L1461: }), r; L1462: }, q = "md-editor", Xa = "MdEditor", Za = "https://unpkg.com", Qa = `${Za}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, $a = { L1463: main: `${Za}/prettier@3.8.1/standalone.js`, ... L2276: if (typeof e == "string") { L2277: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2278: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L102

873ur(async () => { L874: let { CodeEditor: e } = await import("monaco-editor-vue3"); L875: l.value = e;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/index.jsView on unpkg · L873

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"Puoi collegare solo account che usano la stessa email del tuo profilo.\",\"accountLinkError\":\"Impossibile col... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"You can only link accounts that use the same email as your profile.\",\"accountLinkError\":\"Unable to link the...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View on unpkg

dist/_chunks/iconify-tggsk9QV.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.105.0 matchedPath = dist/_chunks/iconify-tggsk9QV.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.105.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/_chunks/iconify-tggsk9QV.jsView on unpkg

dist-vue/_chunks/PkStreamingMarkdown-DM_5YqQX.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @8wave/ai-elements@0.104.0 matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.104.0 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-vue/_chunks/PkStreamingMarkdown-DM_5YqQX.jsView on unpkg

dist/_chunks/index.es-DB9_sQvG.jsView file

174patternName = generic_password severity = medium line = 174

Medium

Secret Pattern

Hardcoded password in dist/_chunks/index.es-DB9_sQvG.js

dist/_chunks/index.es-DB9_sQvG.jsView on unpkg · L174

dist-vue/_chunks/web-Deav1PAL.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/web-Deav1PAL.js

dist-vue/_chunks/web-Deav1PAL.jsView on unpkg · L7027

dist-vue/_chunks/index.es-C9x5eMBe.jsView file

287patternName = generic_password severity = medium line = 287

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/index.es-C9x5eMBe.js

dist-vue/_chunks/index.es-C9x5eMBe.jsView on unpkg · L287

dist-vue/locales.jsView file

255patternName = generic_password severity = medium line = 255

Medium

Secret Pattern

Hardcoded password in dist-vue/locales.js

dist-vue/locales.jsView on unpkg · L255

788patternName = generic_password severity = medium line = 788

Medium

Secret Pattern

Hardcoded password in dist-vue/locales.js

dist-vue/locales.jsView on unpkg · L788

Source & flagged code

12 flagged

dist/_chunks/web-Deav1PAL.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/_chunks/web-Deav1PAL.jsView on unpkg · L7027

dist-vue/index.jsView file

102title: u(), L103: body: u().nullable(), L104: groupKey: u().nullable(), ... L608: try { L609: let r = a ? JSON.parse(a) : null; L610: i = !0, t.value = r ? Bi(r) : "object", n.value = r ? Vi(r) : [], e.value = r, ar(() => { ... L1461: }), r; L1462: }, q = "md-editor", Xa = "MdEditor", Za = "https://unpkg.com", Qa = `${Za}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, $a = { L1463: main: `${Za}/prettier@3.8.1/standalone.js`, ... L2276: if (typeof e == "string") { L2277: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2278: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L102

873ur(async () => { L874: let { CodeEditor: e } = await import("monaco-editor-vue3"); L875: l.value = e;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/index.jsView on unpkg · L873

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"Puoi collegare solo account che usano la stessa email del tuo profilo.\",\"accountLinkError\":\"Impossibile col... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"accountLinkEmailMismatch\":\"You can only link accounts that use the same email as your profile.\",\"accountLinkError\":\"Unable to link the...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-BXmBY3JI.js#virtual:normalized:round1View on unpkg

dist/_chunks/iconify-tggsk9QV.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.105.0 matchedPath = dist/_chunks/iconify-tggsk9QV.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.105.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/_chunks/iconify-tggsk9QV.jsView on unpkg

dist-vue/_chunks/PkStreamingMarkdown-DM_5YqQX.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @8wave/ai-elements@0.104.0 matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.104.0 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-vue/_chunks/PkStreamingMarkdown-DM_5YqQX.jsView on unpkg

dist/_chunks/index.es-DB9_sQvG.jsView file

Lines 154-194javascript

154 }

155 flatten(e = (e) => e.message) {

156 let t = Object.create(null), n = [];

157

dist-vue/_chunks/web-Deav1PAL.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/web-Deav1PAL.js

dist-vue/_chunks/web-Deav1PAL.jsView on unpkg · L7027

dist-vue/_chunks/index.es-C9x5eMBe.jsView file

Lines 267-307javascript

267 if (i.length === 0) return e;

268 for (let t = 0; t < i.length; t++) {

dist-vue/locales.jsView file

Lines 235-275javascript

235 loadDelay: "Load Delay (ms)",

236 loaderStrategy: "Loader Strategy",

237 loaderStrategyInlineModule: "Inline Module",

238 loaderStrategyScriptSrc: "Script Src",

239 loaderStrategyDynamicImport