registry / @aestheticfunction/dspack-emit / 0.3.1

@aestheticfunction/dspack-emit@0.3.1

dspack emitters: compile a dspack design-system contract and dspack surfaces into protocol targets — an A2UI catalog + surface messages (gates A1-A3) and json-render catalog/registry modules + specs (gates J1-J3).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 214 KB of source, external domains: json-schema.org, rdombrowski.dev

Source & flagged code

2 flagged

dist/transform/profiles.jsView file

Lines 78-118javascript

78 schema: DynStr,

79 description: "The text label for the input field.",

80 synthNote: "A2UI TextField owns its label; dspack Input relies on an external <label> element, " +

81 "so the label is synthesized.",

82 },

83 value: {

84 schema: DynStr,

85 description: "The bound value of the text field.",

86 synthNote: "A2UI two-way-binds value; dspack Input has no value prop in the contract.",

87 },

88 },

89 propMap: {

90 type: {

91 a2ui: "variant",

92 kind: "enum",

93 targetEnum: ["shortText", "longText", "number", "obscured"],

94 valueMap: {

95 text: "shortText",

96 email: "shortText",

97 search: "shortText",

98 password: "obscured",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/transform/profiles.jsView on unpkg · L98

99 number: "number",

100 },

101 default: "shortText",

102 description: "Input kind, projected from the HTML input type onto A2UI TextField variants.",

103 },

104 },

105 required: ["label"],

106 surfacePlan: { textProp: "label" },

107 },

108 {

109 // shadcn Badge -> a real A2UI Badge component shape (variant enum carried verbatim).

110 a2ui: "Badge",

111 dspackId: "badge",

112 commons: ["ComponentCommon"],

113 structural: {

114 label: {

115 schema: DynStr,

116 description: "The badge text.",

117 synthNote: "A2UI has no Badge; the label is synthesized from the badge's text child.",

118 },

src/transform/profiles.tsView file

Lines 213-253typescript

213 description: "The text label for the input field.",

214 synthNote:

215 "A2UI TextField owns its label; dspack Input relies on an external <label> element, " +

216 "so the label is synthesized.",

217 },

218 value: {

219 schema: DynStr,

220

Source & flagged code

2 flagged · loading source

dist/transform/profiles.jsView file

98patternName = generic_password severity = medium line = 98 matchedText = password...ed",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/transform/profiles.jsView on unpkg · L98

src/transform/profiles.tsView file

233patternName = generic_password severity = medium line = 233 matchedText = password...ed",

Medium

Secret Pattern

Hardcoded password in src/transform/profiles.ts

src/transform/profiles.tsView on unpkg · L233

Findings

2 Medium5 Low

MediumSecret Patterndist/transform/profiles.js

MediumSecret Patternsrc/transform/profiles.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/transform/profiles.jsView file

Lines 78-118javascript

78 schema: DynStr,

79 description: "The text label for the input field.",

80 synthNote: "A2UI TextField owns its label; dspack Input relies on an external <label> element, " +

81 "so the label is synthesized.",

82 },

83 value: {

84 schema: DynStr,

85 description: "The bound value of the text field.",

86 synthNote: "A2UI two-way-binds value; dspack Input has no value prop in the contract.",

87 },

88 },

89 propMap: {

90 type: {

91 a2ui: "variant",

92 kind: "enum",

93 targetEnum: ["shortText", "longText", "number", "obscured"],

94 valueMap: {

95 text: "shortText",

96 email: "shortText",

97 search: "shortText",

98 password: "obscured",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/transform/profiles.jsView on unpkg · L98

99 number: "number",

100 },

101 default: "shortText",

102 description: "Input kind, projected from the HTML input type onto A2UI TextField variants.",

103 },

104 },

105 required: ["label"],

106 surfacePlan: { textProp: "label" },

107 },

108 {

109 // shadcn Badge -> a real A2UI Badge component shape (variant enum carried verbatim).

110 a2ui: "Badge",

111 dspackId: "badge",

112 commons: ["ComponentCommon"],

113 structural: {

114 label: {

115 schema: DynStr,

116 description: "The badge text.",

117 synthNote: "A2UI has no Badge; the label is synthesized from the badge's text child.",

118 },

src/transform/profiles.tsView file

Lines 213-253typescript

213 description: "The text label for the input field.",

214 synthNote:

215 "A2UI TextField owns its label; dspack Input relies on an external <label> element, " +

216 "so the label is synthesized.",

217 },

218 value: {

219 schema: DynStr,

220