registry / @appsbd/vue3-appsbd-ui / 1.0.16

@appsbd/vue3-appsbd-ui@1.0.16

⚠ Under review

Reusable Vue 3 component library

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 2.53 MB of source, external domains: github.com, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 16-56json

16 },

17 "./style.css": "./dist/style.css",

18 "./skins/*.css": "./dist/skins/*.css",

19 "./skins/*.scss": "./dist/skins/*.scss",

20 "./skins/themes/*.scss": "./dist/skins/themes/*.scss"

21 },

22 "files": [

23 "dist",

24 "readme.md",

25 "CHANGELOG.md",

26 "AI_REFERENCE.md",

27 "AI_REF.md",

28 ".ai",

29 "skills",

30 "scripts/postinstall.js",

31 "scripts/setup.js",

32 "scripts/skill-groups.js",

33 "design-system.md"

34 ],

35 "scripts": {

36 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "up": "npm run build && npm publish",

38 "dev": "vite --mode playground",

39 "lib": "vite",

40 "build": "vite build",

41 "build:playground": "vite build --mode playground",

42 "build:skins": "vite build --mode skins"

43 },

44 "keywords": [

45 "vue",

46 "vue3",

47 "component-library",

48 "vite"

49 ],

50 "author": "appsbd",

51 "license": "MIT",

52 "peerDependencies": {

53 "@appsbd/vue3-elite-grid": ">=2.0.4",

54 "@lucide/vue": ">=1.28.0",

55 "@vee-validate/rules": ">=4.15.1",

56 "bootstrap": ">=5.3.7",

dist/vue3-appsbd-ui.cjs.jsView file

310.vue-echarts-inner{flex-grow:1;min-width:0;width:auto!important;height:auto!important} L311: `,{});var D$=function(){if(go!=null)return go;if(typeof HTMLElement>"u"||typeof customElements>"u")return go=!1;try{new Function("tag",`class EChartsElement extends HTMLElement { L312: __dispose = null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vue3-appsbd-ui.cjs.jsView on unpkg · L310

scripts/skill-groups.jsView file

Lines 1-21javascript

1import { join } from "path";

3// Central config for all agent skill destinations.

4// Add new agents here — postinstall.js and setup.js both use this.

6const OPTIONAL_AGENTS = {

7 cursor: (pkgRoot,

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

@appsbd/vue3-appsbd-ui@1.0.16

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code