registry / @anov/base-component / 1.0.0

@anov/base-component@1.0.0

AI Security Review

scanned 21h ago · by lpm-firewall-ai

The optional full bundle installs a global shared helper object. A host that invokes its dynamic module loaders with untrusted code or URLs can execute that module in the browser context; the package does not do so autonomously.

Static reason

No blocking static signals were detected.

Trigger

Import dist/anov-base-component.full.mjs, then caller invocation of loadModuleWithCode or loadModuleWithUrl.

Impact

Potential browser-context code execution if an application passes untrusted code or URLs.

Mechanism

Globally exposed caller-controlled dynamic module import

Rationale

The primary package is a component library with no install-time behavior, but its shipped full bundle exposes broadly reachable dynamic code-loading helpers. This is a dangerous dual-use capability rather than evidence of autonomous malware.

Evidence

package.jsondist/anov-base-component.mjsdist/anov-base-component.full.mjs

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/anov-base-component.full.mjs exposes loadModuleWithCode, which imports caller-supplied JavaScript from a Blob.
dist/anov-base-component.full.mjs exposes loadModuleWithUrl, which dynamically imports a caller-supplied URL.
The full bundle assigns these helpers to globalThis.anovui.shared at import time.
The full bundle also provides fetch-based request helpers for caller-supplied URLs.

Evidence against

package.json has no preinstall, install, postinstall, prepare, or bin hook.
The primary module entry is a Vue/Arco component bundle with icon DOM injection only.
No hard-coded external network endpoint was found.
No credential harvesting, filesystem access, shell execution, or agent-control mutation was found.

Behavioral surface

Source

CryptoDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Source & flagged code

1 flagged

dist/anov-base-component.full.mjsView file

Lines 7799-7839javascript

7799 });

7800 }

7801}

7802function getMapTile(option) {

7803 return __async(this, null, function* () {

7804 const mapTile = new MapTile(option);

7805 return mapTile.getMapTile();

7806 });

7807}

7808function sum2(nums, key) {

7809 if (!(nums == null ? void 0 : nums.length)) {

7810 return 0;

7811 }

7812 if (key) {

7813 return sum2(nums.map((item) => +item[key]));

7814 } else {

7815 return nums.reduce((s, n) => s + n, 0);

7816 }

7817}

7818function loadModuleWithUrl(url) {

7819 return __async(this, null, function* () {

7820 const module = yield import(url);

7821 return module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/anov-base-component.full.mjsView on unpkg · L7819

7822 });

7823}

7824function loadModuleWithCode(code) {

7825 return __async(this, null, function* () {

7826 const blob = new Blob([code], { type: "text/javascript" });

7827 const url = URL.createObjectURL(blob);

7828 const module = yield import(url);

7829 return {

7830 url,

7831 module,

7832 revoke: () => URL.revokeObjectURL(url)

7833 };

7834 });

7835}

7836function computePos(anchor, target, placement) {

7837 const position = { left: 0, top: 0 };

7838 switch (placement) {

7839 case "top-left":

Source & flagged code

1 flagged · loading source

dist/anov-base-component.full.mjsView file

7819return __async(this, null, function* () { L7820: const module = yield import(url); L7821: return module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/anov-base-component.full.mjsView on unpkg · L7819

Findings

3 Medium6 Low

MediumDynamic Requiredist/anov-base-component.full.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License