@8wave/ai-elements@0.110.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@8wave/ai-elements@0.110.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/_chunks/index.es-BJnUA_36.jsView file

30patternName = generic_password severity = medium line = 30

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/_chunks/index.es-BJnUA_36.jsView on unpkg · L30

dist-vue/index.jsView file

103title: c(), L104: body: c().nullable(), L105: groupKey: c().nullable(), ... L753: try { L754: let r = a ? JSON.parse(a) : null; L755: i = !0, t.value = r ? ra(r) : "object", n.value = r ? ia(r) : [], e.value = r, dr(() => { ... L1604: }), r; L1605: }, q = "md-editor", mo = "MdEditor", ho = "https://unpkg.com", go = `${ho}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, _o = { L1606: main: `${ho}/prettier@3.8.1/standalone.js`, ... L2419: if (typeof e == "string") { L2420: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2421: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L103

1018gr(async () => { L1019: let { CodeEditor: e } = await import("monaco-editor-vue3"); L1020: l.value = e;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/index.jsView on unpkg · L1018

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkAlreadyLinked\":\"Questo account è già collegato a un altro utente. Accedi con quell'utente per scollegarlo prima.\",\"accountLin... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"accountLinkAlreadyLinked\":\"This account is already linked to another user. Sign in with that user to unlink it first.\",\"accountLinkCance...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/_chunks/dist-Csm5xBQw.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-Csm5xBQw.js#virtual:normalized:round1View on unpkg

dist-vue/_chunks/PkStreamingMarkdown-D8_LwZMR.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.109.0 matchedPath = dist-vue/_chunks/PkStreamingMarkdown-D8_LwZMR.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.109.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-vue/_chunks/PkStreamingMarkdown-D8_LwZMR.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @8wave/ai-elements@0.106.0 matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.106.0 similarity = 0.717 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-vue/_chunks/PkStreamingMarkdown-D8_LwZMR.jsView on unpkg

dist/_chunks/iconify-CDwuCpbE.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.109.0 matchedPath = dist/_chunks/iconify-CpjEsXoO.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.109.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/_chunks/iconify-CDwuCpbE.jsView on unpkg

dist/_chunks/web-Dzr6HJ14.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Hardcoded password in dist/_chunks/web-Dzr6HJ14.js

dist/_chunks/web-Dzr6HJ14.jsView on unpkg · L7027

Source & flagged code

9 flagged

dist/_chunks/index.es-BJnUA_36.jsView file

Lines 10-50javascript

10 try {

11 return window.localStorage.getItem(""), j(e, t);

12 } catch (e) {

13 return k.warn("[useSafeLocalStorage] localStorage blocked, falling back to in-memory ref", e), S(t);

14 }

15}

16//#endregion

17//#region ../../packages/composable/src/useLocalizedString.ts

18l(), y();

19function I(e, t) {

20 let { locale: n, t: r, te: i } = O({ useScope: "global" });

21 return x(() => {

22 let a = D(e), o = t !== void 0 && i(t) ? r(t) : void 0;

23 return a && a[n.value] || o;

24 });

25}

26//#endregion

27//#region ../../node_modules/.pnpm/@volverjs+form-vue@1.1.7_@volverjs+ui-vue@0.0.22_@json-render+core@0.19.0_zod@4.6.5__@v_044a7a439169315d3eeb6b7ca55cd1f3/node_modules/@volverjs/form-vue/dist/index.es.js

28l(), y(), C();

29var L = /* @__PURE__ */ function(e) {

30 return e.text = "text", e.number = "number", e.email = "email", e.password = "password", e.tel = "tel", e.url = "url", e.search = "search", e.date = "date", e.time

31}({}), R = /* @__PURE__ */ function(e) {

32 return e.invalid = "invalid", e.valid = "valid", e.submitting = "submitting", e.reset = "reset", e.updated = "updated", e.unknown = "unknown", e;

33}({}), z = (e) => e._def.typeName === "ZodObject", B = (e) => e._zod.def.type === "object", V = (e) => e._def.typeName === "ZodDefault"

34function q(e) {

35 let t = e;

36 for (; oe(t);) t = t.innerType();

37 return t;

38}

39function J(e) {

40 let t = e;

41 for (; G(t);) t = K(t._zod.def.out) ? t._zod.def.in : t._zod.def.out;

42 return t;

43}

44var se = (e) => {

45 let t = q(e);

46 return U(t) && (t = t._def.innerType), t;

47}, ce = (e) => {

48 let t = J(e);

49 return W(t) && (t = t._zod.def.innerType), t;

50}, le = (e) => !!U(q(e)), ue = (e) => !!W(J(e)), Y = (e) => "_zod"

Long lines were clipped for display.

dist-vue/index.jsView file

103title: c(), L104: body: c().nullable(), L105: groupKey: c().nullable(), ... L753: try { L754: let r = a ? JSON.parse(a) : null; L755: i = !0, t.value = r ? ra(r) : "object", n.value = r ? ia(r) : [], e.value = r, dr(() => { ... L1604: }), r; L1605: }, q = "md-editor", mo = "MdEditor", ho = "https://unpkg.com", go = `${ho}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, _o = { L1606: main: `${ho}/prettier@3.8.1/standalone.js`, ... L2419: if (typeof e == "string") { L2420: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2421: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L103

1018gr(async () => { L1019: let { CodeEditor: e } = await import("monaco-editor-vue3"); L1020: l.value = e;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/index.jsView on unpkg · L1018

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkAlreadyLinked\":\"Questo account è già collegato a un altro utente. Accedi con quell'utente per scollegarlo prima.\",\"accountLin... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"accountLinkAlreadyLinked\":\"This account is already linked to another user. Sign in with that user to unlink it first.\",\"accountLinkCance...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/_chunks/dist-Csm5xBQw.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-Csm5xBQw.js#virtual:normalized:round1View on unpkg

dist-vue/_chunks/PkStreamingMarkdown-D8_LwZMR.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.109.0 matchedPath = dist-vue/_chunks/PkStreamingMarkdown-D8_LwZMR.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.109.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-vue/_chunks/PkStreamingMarkdown-D8_LwZMR.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @8wave/ai-elements@0.106.0 matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.106.0 similarity = 0.717 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-vue/_chunks/PkStreamingMarkdown-D8_LwZMR.jsView on unpkg

dist/_chunks/iconify-CDwuCpbE.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.109.0 matchedPath = dist/_chunks/iconify-CpjEsXoO.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.109.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/_chunks/iconify-CDwuCpbE.jsView on unpkg

dist/_chunks/web-Dzr6HJ14.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Hardcoded password in dist/_chunks/web-Dzr6HJ14.js

dist/_chunks/web-Dzr6HJ14.jsView on unpkg · L7027