@8wave/ai-elements@0.90.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@8wave/ai-elements@0.90.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/_chunks/index.es-CxQ095pQ.jsView file

2119patternName = generic_password severity = medium line = 2119 matchedText = return e..., e;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/_chunks/index.es-CxQ095pQ.jsView on unpkg · L2119

dist-vue/_chunks/livescript-DqyJp1V5.jsView file

16return e.next(), "error"; L17: }, t = "(?![\\d\\s])[$\\w\\xAA-\\uFFDC](?:(?!\\s)[$\\w\\xAA-\\uFFDC]|-[A-Za-z])*", n = RegExp("(?:[({[=:]|[-~]>|\\b(?:e(?:lse|xport)|d(?:o|efault)|t(?:ry|hen)|finally|import(?:\\s*... L18: token: "string",

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/_chunks/livescript-DqyJp1V5.jsView on unpkg · L16

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"copied\":\"Copiato negli appunti\",\"unauthorized\":\"Non hai i permessi per gestire i canali.\",\"accountLinkEmailMismatch\":\"Puoi collega... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"copied\":\"Copied to clipboard\",\"unauthorized\":\"You do not have permission to manage channels.\",\"accountLinkEmailMismatch\":\"You can ...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/index.jsView file

97title: D(), L98: body: D().nullable(), L99: groupKey: D().nullable(), ... L603: try { L604: let r = a ? JSON.parse(a) : null; L605: i = !0, t.value = r ? zi(r) : "object", n.value = r ? Bi(r) : [], e.value = r, rr(() => { ... L1952: if (n && r) try { L1953: t = new globalThis.Request("https://empty.invalid", { L1954: body: new globalThis.ReadableStream(), ... L4040: if (typeof e == "string") { L4041: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L4042: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L97

dist/_chunks/iconify-CpEu9650.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @8wave/ai-elements@0.95.0 matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.95.0 similarity = 0.492 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/_chunks/iconify-CpEu9650.jsView on unpkg

dist-vue/_chunks/index.es-ChKj3bPm.jsView file

135patternName = generic_password severity = medium line = 135 matchedText = return e..., e;

Medium

Secret Pattern

Hardcoded password in dist-vue/_chunks/index.es-ChKj3bPm.js

dist-vue/_chunks/index.es-ChKj3bPm.jsView on unpkg · L135

dist-vue/locales.jsView file

219patternName = generic_password severity = medium line = 219 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist-vue/locales.js

dist-vue/locales.jsView on unpkg · L219

675patternName = generic_password severity = medium line = 675 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist-vue/locales.js

dist-vue/locales.jsView on unpkg · L675

Source & flagged code

8 flagged

dist/_chunks/index.es-CxQ095pQ.jsView file

Lines 2099-2139javascript

2099//#region ../../packages/composable/src/useSafeLocalStorage.ts

2100function zr(e, t) {

2101 try {

2102 return window.localStorage.getItem(""), A(e, t);

2103 } catch (e) {

2104 return D.warn("[useSafeLocalStorage] localStorage blocked, falling back to in-memory ref", e), b(t);

2105 }

2106}

2107//#endregion

2108//#region ../../packages/composable/src/useLocalizedString.ts

2109function Br(e, t) {

2110 let { locale: n, t: r, te: i } = Dr({ useScope: "global" });

2111 return l(() => {

2112 let a = E(e), o = t !== void 0 && i(t) ? r(t) : void 0;

2113 return a && a[n.value] || o;

2114 });

2115}

2116//#endregion

2117//#region ../../node_modules/.pnpm/@volverjs+form-vue@1.1.4_@volverjs+ui-vue@0.0.15_@volverjs+style@0.1.24_@vueuse+core@14_cb8623beefb45b85514471079a1fff82/node_modules/@volverjs/form-vue/dist/index.es.js

2118var Q = /* @__PURE__ */ function(e) {

2119 return e.text = "text", e.number = "number", e.email = "email", e.password = "password", e.tel = "tel", e.url = "url", e.search = "search", e.date = "date", e.time

2120}({}), $ = /* @__PURE__ */ function(e) {

2121 return e.invalid = "invalid", e.valid = "valid", e.submitting = "submitting", e.reset = "reset", e.updated = "updated", e.unknown = "unknown", e;

2122}({}), Vr = (e) => e._def.typeName === "ZodObject", Hr = (e) => e._zod.def.type === "object", Ur = (e) => e._def.typeName ===

2123function ni(e) {

2124 let t = e;

2125 for (; Zr(t);) t = t.innerType();

2126 return t;

2127}

2128function ri(e) {

2129 let t = e;

2130 for (; ei(t);) t = ti(t._zod.def.out) ? t._zod.def.in : t._zod.def.out;

2131 return t;

2132}

2133var ii = (e) => {

2134 let t = ni(e);

2135 return Qr(t) && (t = t._def.innerType), t;

2136}, ai = (e) => {

2137 let t = ri(e);

2138 return $r(t) && (t = t._zod.def.innerType), t;

2139}, oi = (e) => !!Qr(ni(e)), si = (e) => !!$r(ri(e)), ci = (e) => "_zod"

Long lines were clipped for display.

dist-vue/_chunks/livescript-DqyJp1V5.jsView file

Lines 1-36javascript

1//#region ../../node_modules/.pnpm/@codemirror+legacy-modes@6.5.3/node_modules/@codemirror/legacy-modes/mode/livescript.js

2var e = function(e, t) {

3 var n = t.next || "start";

4

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"copied\":\"Copiato negli appunti\",\"unauthorized\":\"Non hai i permessi per gestire i canali.\",\"accountLinkEmailMismatch\":\"Puoi collega... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com", message: /* @__PURE__ */ JSON.parse("{\"copied\":\"Copied to clipboard\",\"unauthorized\":\"You do not have permission to manage channels.\",\"accountLinkEmailMismatch\":\"You can ...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/index.jsView file

97title: D(), L98: body: D().nullable(), L99: groupKey: D().nullable(), ... L603: try { L604: let r = a ? JSON.parse(a) : null; L605: i = !0, t.value = r ? zi(r) : "object", n.value = r ? Bi(r) : [], e.value = r, rr(() => { ... L1952: if (n && r) try { L1953: t = new globalThis.Request("https://empty.invalid", { L1954: body: new globalThis.ReadableStream(), ... L4040: if (typeof e == "string") { L4041: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L4042: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L97

dist/_chunks/iconify-CpEu9650.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @8wave/ai-elements@0.95.0 matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.95.0 similarity = 0.492 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/_chunks/iconify-CpEu9650.jsView on unpkg

dist-vue/_chunks/index.es-ChKj3bPm.jsView file

Lines 115-155javascript

115 return e === void 0 ? n : e;

116}

117function F(e, t, n) {

118

dist-vue/locales.jsView file

Lines 199-239javascript

199 loadDelay: "Load Delay (ms)",

200 loaderStrategy: "Loader Strategy",

201 loaderStrategyInlineModule: "Inline Module",

202 loaderStrategyScriptSrc: "Script Src",

203 loaderStrategyDynamicImport