registry  /  @aidapt/caity-chat  /  3.5.1

@aidapt/caity-chat@3.5.1

Interfaccia di chat embeddabile distribuita come **Web Component standard** (`<caity-chat>`). Funziona in qualsiasi pagina o framework — senza dipendere da React lato consumer — e renderizza tutta la UI dentro uno **Shadow DOM**, così gli stili della chat

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedTelemetryUrlStrings
Manifest
NoLicense
scanned 131 file(s), 11.9 MB of source, external domains: api.skill.caity.it, caity.invalid, cataas.com, chevrotain.io, crbug.com, developer.mozilla.org, doc.rust-lang.org, docs.docker.com, docs.microsoft.com, en.cppreference.com, en.wikibooks.org, en.wikipedia.org, example.com, fb.me, github.com, jsonlines.org, langium.org, link.com, openjdk.java.net, paulrosen.github.io, picsum.photos, react.dev, s2.q4cdn.com, stackoverflow.com, tex.stackexchange.com, www.aidaptsrl.com, www.gnu.org, www.iana.org, www.php.net, www.soundhelix.com, www.w3.org, www.w3schools.com

Source & flagged code

7 flagged · loading source
dist/lib/katex.min-DM77rphu.jsView file
1patternName = aws_access_key severity = critical line = 1 matchedText = const A ...o}';
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/katex.min-DM77rphu.jsView on unpkg · L1
1patternName = aws_access_key severity = critical line = 1 matchedText = const A ...o}';
Critical
Secret Pattern

AWS access key ID in dist/lib/katex.min-DM77rphu.js

dist/lib/katex.min-DM77rphu.jsView on unpkg · L1
dist/lib/index-7Fq0Y6Sm.jsView file
16607pattern: RegExp( L16608: /(\b(?:exports|import(?:\s+static)?|module|open|opens|package|provides|requires|to|transitive|uses|with)\s+)(?!<keyword>)[a-z]\w*(?:\.[a-z]\w*)*\.?/.source.replace( L16609: /<keyword>/g,
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/index-7Fq0Y6Sm.jsView on unpkg · L16607
dist/lib/caity-chat.tgzView file
•path = dist/lib/caity-chat.tgz kind = high_entropy_blob sizeBytes = 3516187 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/lib/caity-chat.tgzView on unpkg
•path = dist/lib/caity-chat.tgz kind = compressed_blob sizeBytes = 3516187 magicHex = [redacted]
Medium
Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/lib/caity-chat.tgzView on unpkg
•path = dist/lib/caity-chat.tgz kind = nested_archive_needs_inspection sizeBytes = 3516187 magicHex = [redacted]
Low
Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/lib/caity-chat.tgzView on unpkg
dist/lib/index-BbaFKN3U.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @aidapt/caity-chat@3.4.0 matchedIdentity = npm:QGFpZGFwdC9jYWl0eS1jaGF0:3.4.0 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/index-BbaFKN3U.jsView on unpkg

Findings

2 Critical2 High4 Medium7 Low
CriticalCritical Secretdist/lib/katex.min-DM77rphu.js
CriticalSecret Patterndist/lib/katex.min-DM77rphu.js
HighShips High Entropy Blobdist/lib/caity-chat.tgz
HighPrevious Version Dangerous Deltadist/lib/index-BbaFKN3U.js
MediumDynamic Requiredist/lib/index-7Fq0Y6Sm.js
MediumNetwork
MediumShips Compressed Blobdist/lib/caity-chat.tgz
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNested Archive Needs Inspectiondist/lib/caity-chat.tgz
LowNo License