registry / @arcgis/portal-components / 5.1.9

@arcgis/portal-components@5.1.9

ArcGIS Portal Components

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 92 file(s), 1.92 MB of source, external domains: apac.smith.langchain.com, api.openai.com, api.smith.langchain.com, auth.openai.com, aws.smith.langchain.com, beta.smith.langchain.com, dev.smith.langchain.com, docs.expo.dev, docs.langchain.com, eu.smith.langchain.com, github.com, help.openai.com, js.arcgis.com, js.langchain.com, json-schema.org, platform.openai.com, smith.langchain.com, status.arcgis.com, www.arcgis.com, www.w3.org

Source & flagged code

3 flagged

dist/cdn/VX5R3DJI.jsView file

Lines 1-28javascript

1/* COPYRIGHT Esri - https://js.arcgis.com/5.1/LICENSE.txt */

2import a from"./XR4PMNYP.js";import"./BCUEYBNI.js";import{a as ao,b as pl}from"./4ISLOZQ3.js";import{a as dl}from"./6XUBO6K5.js";import"./OZN2IHQK.js";import{I as oo,J as so,K as ul,Q as cl,h as sl,j as Or,m as al,v as il,y as ll}from"./LI6757JN.js";import{$ as De,$a as N,Aa as bt,Ba as qe,Ca as us,D as hl,Da as Ml,E as Xe,Ea as Pl,F as gl,Fa as cs,G as ts,Ga as Rl,H as xa,Ha as Rr,I as Aa,Ia as Ca,J as rs,Ja as Nl,K as Ia,Ka as $l,L as lo,La as po,M as U,Ma as Ll,N as va,Na as mo,O as yl,Oa as fo,P as R,Pa as I,Q as yt,Qa as D,R as et,Ra as Ea,S as ns,T as _l,U as wl,V as Ta,W as Ae,X as os,Y ...

4If you continue to see this error, please import from "@langchain/core/callbacks/dispatch/web"`,"and explicitly pass in a config parameter.",`

6Or, if you are calling this from a custom tool, ensure you're using the "tool" helper constructor as documented here:`,`

7 |`,`

8 \u2514-> https://js.langchain.com/docs/how_to/custom_tools#tool-function`,`

9`].join(" "));let n=await xl(r),o=n?.getParentRunId();n!==void 0&&o!==void 0&&await n.handleCustomEvent?.(t,e,o)}var ee=async(t,e)=>{await Ma("trace_message",t,e)},_e=async(t,e)=>{await Ma("graph_ux_suggestion",t,e)};var fs={openai:{package:"@langchain/openai",className:"ChatOpenAI"},anthropic:{package:"@langchain/anthropic",className:"ChatAnthropic"},azure_openai:{package:"@langchain/openai",className:"AzureChatOpenAI"},cohere:{package:"@langchain/cohere",className:"ChatCohere"},google:{package:"@langchain/google",className:"ChatGoogle"},"google-vertexai":{package:"@langchain/google-vertexai" ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cdn/VX5R3DJI.jsView on unpkg · L8

11Supported model providers are: ${i}`)}let{modelProvider:s,...a}=r;return new(await jp(o.className,n))({model:t,...a})}function Dp(t){return t.startsWith("gpt-3")||t.startsWith("gpt-4")||t.startsWith("gpt-5")||t.startsWith("o1")||t.startsWith("o3")||t.startsWith("o4")?"openai":t.startsWith("claude")?"anthropic":t.startsWith("command")?"cohere":t.startsWith("accounts/fireworks")?"fireworks":t.startsWith("gemini")?"google-vertexai":t.startsWith("amazon.")?"bedrock":t.startsWith("mistral")?"mistralai":t.startsWith("sonar")||t.startsWith("pplx")?"perplexity":void 0}var Bl=class ms extends po{_llmTy ...

12 - ${r}`).join("")}.`),this.toolName=t,this.errors=e}},ys=class extends Error{toolCall;toolError;constructor(t,e){let r=t instanceof Error?t:new Error(String(t)),n=JSON.stringify(e.args);super(`Error invoking tool '${e.name}' with kwargs ${n} with error: ${r.stack}

13 Please fix the error and try again.`),this.toolCall=e,this.toolError=r}},yo=class Wl extends Error{static"~brand"="MiddlewareError";constructor(e,r){let n=e instanceof Error?e.message:String(e);super(n),this.name=e instanceof Error?e.name:`${r[0].toUpperCase()+r.slice(1)}Error`,e instanceof Error&&(this.cause=e)}static wrap(e,r){return fl(e)?e:new Wl(e,r)}static isInstance(e){return e instanceof Error&&"~brand"in e&&e["~brand"]==="MiddlewareError"}};function _o(t){return"invoke"in t&&typeof t.invoke=="function"&&"_streamResponseChunks"in t}function Nr(t){return typeof t=="object"&&t!=null&&"_ ...

14All items must be either InteropZodObject, Standard Schema, or plain JSON schema objects.`)}if(t instanceof Ee||t instanceof It)return[t];let n=qp(r);if(_t(t))return n?[It.fromSchema(t)]:[Ee.fromSchema(t,e)];if(rt(t))return n?[It.fromSchema(t)]:[Ee.fromSchema(t,e)];if(typeof t=="object"&&t!==null&&"properties"in t)return n?[It.fromSchema(t)]:[Ee.fromSchema(t,e)];throw new Error(`Invalid response format: ${String(t)}`)}function qp(t){return!t||!_o(t)||!("profile"in t)||typeof t.profile!="object"||!t.profile?!1:"structuredOutput"in t.profile&&t.profile.structuredOutput===!0}function Ue(t){if(!(! ...

15`);throw new Error(`Middleware "${n.name}" has required state fields that must be initialized:

16${a}

18To fix this, either:

191. Provide default values in your middleware's state schema using .default():

20 stateSchema: z.object({

21 myField: z.string().default("default value")

22 })

242. Or make the fields optional using .optional():

25 stateSchema: z.object({

26 myField: z.string().optional()

27 })

Long lines were clipped for display.

dist/cdn/YJK6JAPE.jsView file

1/* COPYRIGHT Esri - https://js.arcgis.com/5.1/LICENSE.txt */ L2: import{a as vn,b as bn,c as pa}from"./CFDTXKJ6.js";var cS=vn((q9,sS)=>{"use strict";sS.exports=function(e,t){if(typeof e!="string")throw new TypeError("Expected a string");return t... L3: L4: Troubleshooting URL: https://docs.langchain.com/oss/javascript/langgraph/${t.lc_error_code}/ L5: `),super(r),this.lc_error_code=t?.lc_error_code}},Xm=class extends Jr{get is_bubble_up(){return!0}},Ym=class extends Jr{constructor(e,t){super(e,t),this.name="GraphRecursionError"}... L6: L7: Troubleshooting URL: https://docs.langchain.[redacted]/${t}/ L8: `,e}var Nl=MS.sub("error"),yh=class extends Nl.brand(Error){name="LangChainError";constructor(e){super(e),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor)}},... L9: `)}var bh=Symbol.for("langchain.message");function YS(e){return Array.isArray(e)?e:typeof e=="string"?e===""?[]:[{type:"text",text:e}]:e==null?[]:[e]}function At(e,t){if(typeof e==... ... L20: Received: ${JSON.stringify(e,null,2)}`),"MESSAGE_COERCION_FAILURE")}}function St(e){if(typeof e=="string")return new Ye(e);if(Je(e))return e;if(Array.isArray(e)){let[t,r]=e;retu

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cdn/YJK6JAPE.jsView on unpkg · L1

dist/cdn/assets/portal-item-thumbnail/urbanmodel.avifView file

•path = dist/cdn/assets/portal-item-thumbnail/urbanmodel.avif kind = high_entropy_blob sizeBytes = 39345 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cdn/assets/portal-item-thumbnail/urbanmodel.avifView on unpkg

Source & flagged code

3 flagged · loading source

dist/cdn/VX5R3DJI.jsView file

8\u2514-> https://js.langchain.com/docs/how_to/custom_tools#tool-function`,` L9: `].join(" "));let n=await xl(r),o=n?.getParentRunId();n!==void 0&&o!==void 0&&await n.handleCustomEvent?.(t,e,o)}var ee=async(t,e)=>{await Ma("trace_message",t,e)},_e=async(t,e)=>{... L10:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cdn/VX5R3DJI.jsView on unpkg · L8

dist/cdn/YJK6JAPE.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cdn/YJK6JAPE.jsView on unpkg · L1

dist/cdn/assets/portal-item-thumbnail/urbanmodel.avifView file

•path = dist/cdn/assets/portal-item-thumbnail/urbanmodel.avif kind = high_entropy_blob sizeBytes = 39345 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cdn/assets/portal-item-thumbnail/urbanmodel.avifView on unpkg

Findings

2 High5 Medium4 Low

HighCloud Metadata Accessdist/cdn/YJK6JAPE.js

HighShips High Entropy Blobdist/cdn/assets/portal-item-thumbnail/urbanmodel.avif

MediumDynamic Requiredist/cdn/VX5R3DJI.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/cdn/VX5R3DJI.jsView file

Lines 1-28javascript

1/* COPYRIGHT Esri - https://js.arcgis.com/5.1/LICENSE.txt */

4If you continue to see this error, please import from "@langchain/core/callbacks/dispatch/web"`,"and explicitly pass in a config parameter.",`

6Or, if you are calling this from a custom tool, ensure you're using the "tool" helper constructor as documented here:`,`

7 |`,`

8 \u2514-> https://js.langchain.com/docs/how_to/custom_tools#tool-function`,`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cdn/VX5R3DJI.jsView on unpkg · L8

15`);throw new Error(`Middleware "${n.name}" has required state fields that must be initialized:

16${a}

18To fix this, either:

191. Provide default values in your middleware's state schema using .default():

20 stateSchema: z.object({

21 myField: z.string().default("default value")

22 })

242. Or make the fields optional using .optional():

25 stateSchema: z.object({

26 myField: z.string().optional()

27 })

Long lines were clipped for display.

dist/cdn/YJK6JAPE.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cdn/YJK6JAPE.jsView on unpkg · L1

dist/cdn/assets/portal-item-thumbnail/urbanmodel.avifView file

•path = dist/cdn/assets/portal-item-thumbnail/urbanmodel.avif kind = high_entropy_blob sizeBytes = 39345 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cdn/assets/portal-item-thumbnail/urbanmodel.avifView on unpkg