registry / @argusoft/medplat-workflow-configurator / 1.0.28

@argusoft/medplat-workflow-configurator@1.0.28

MEDplat Workflow Configurator

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 90 file(s), 6.46 MB of source, external domains: api.example.com, cdn.jsdelivr.net, clinicaltables.nlm.nih.gov, docs.oasis-open.org, example.com, github.com, motion.dev, openoffice.org, purl.oclc.org, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.openxmlformats.org, tc39.es, www.w3.org

Oversized source lightweight scan

dist/ErrorContextProvider-BnLUtXr3.js2.61 MB file, sampled 256 KB

No sampled risky behavior triggered.

dist/ErrorContextProvider-Dv379vmw.js7.25 MB file, sampled 256 KB

No sampled risky behavior triggered.

dist/pdfmake-Cf-381ou-CKcSM_ag-CHRqO4d-.js2.66 MB file, sampled 256 KB

FilesystemChildProcessEvalShellUrlStringsgithub.com

Source & flagged code

3 flagged

dist/ManageUser-Gv38VHMu-B68GprdY-Dh5RrVUt.jsView file

644patternName = generic_password severity = medium line = 644 matchedText = password...23",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ManageUser-Gv38VHMu-B68GprdY-Dh5RrVUt.jsView on unpkg · L644

dist/ManageAllForms-BrBSYMBd.jsView file

Lines 1133-1173javascript

1133 variableType: f.variableType,

1134 description: f.description ?? "",

1135 setterMethod: f.setterMethod ?? ""

1136 } : {

1137 variableName: "",

1138 variableType: "",

1139 description: "",

1140 setterMethod: ""

1141 });

1142 }, [c, m, f, C]);

1143 const V = () => {

1144 C({

1145 variableName: "",

1146 variableType: "",

1147 description: "",

1148 setterMethod: ""

1149 }), A(!1);

1150 }, B = (g) => {

1151 try {

1152 if (g.setterMethod) {

1153 const S = g.setterMethod.replace(/#\w+#/g, "0");

1154 new Function(S);

1155 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ManageAllForms-BrBSYMBd.jsView on unpkg · L1153

1156 } catch {

1157 F({

1158 message: "Invalid setter method code",

1159 type: "error"

1160 });

1161 return;

1162 }

1163 b(g, f == null ? void 0 : f.uuid);

1164 }, ee = Wt({ control: E, name: "variableName" }), ce = Wt({ control: E, name: "variableType" }), Fe = Wt({ control: E, name: "setterMethod" }), Se = (g) => {

1165 if (g) {

1166 let S = [

1167 "* Note: ",

1168 "* A value must be returned for the changes to be reflected in the UI"

1169 ];

1170 return g === "DATE" && S.push("* For type (Date) return dayjs().valueOf();"), g === "DATE_AND_TIME" && S.push(

1171 "* For type (Date and Time) return dayjs().valueOf();"

1172 ), ` /**

1173 ${S.join(`

dist/ErrorContextProvider-BnLUtXr3.jsView file

•path = dist/ErrorContextProvider-BnLUtXr3.js kind = oversized_source_file sizeBytes = 2735938 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ErrorContextProvider-BnLUtXr3.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/ManageUser-Gv38VHMu-B68GprdY-Dh5RrVUt.jsView file

644patternName = generic_password severity = medium line = 644 matchedText = password...23",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ManageUser-Gv38VHMu-B68GprdY-Dh5RrVUt.jsView on unpkg · L644

dist/ManageAllForms-BrBSYMBd.jsView file

1153const S = g.setterMethod.replace(/#\w+#/g, "0"); L1154: new Function(S); L1155: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ManageAllForms-BrBSYMBd.jsView on unpkg · L1153

dist/ErrorContextProvider-BnLUtXr3.jsView file

•path = dist/ErrorContextProvider-BnLUtXr3.js kind = oversized_source_file sizeBytes = 2735938 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ErrorContextProvider-BnLUtXr3.jsView on unpkg

Findings

1 High4 Medium7 Low

HighOversized Source Filedist/ErrorContextProvider-BnLUtXr3.js

MediumSecret Patterndist/ManageUser-Gv38VHMu-B68GprdY-Dh5RrVUt.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/ManageAllForms-BrBSYMBd.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

dist/ManageUser-Gv38VHMu-B68GprdY-Dh5RrVUt.jsView file

644patternName = generic_password severity = medium line = 644 matchedText = password...23",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ManageUser-Gv38VHMu-B68GprdY-Dh5RrVUt.jsView on unpkg · L644

dist/ManageAllForms-BrBSYMBd.jsView file

Lines 1133-1173javascript

1133 variableType: f.variableType,

1134 description: f.description ?? "",

1135 setterMethod: f.setterMethod ?? ""

1136 } : {

1137 variableName: "",

1138 variableType: "",

1139 description: "",

1140 setterMethod: ""

1141 });

1142 }, [c, m, f, C]);

1143 const V = () => {

1144 C({

1145 variableName: "",

1146 variableType: "",

1147 description: "",

1148 setterMethod: ""

1149 }), A(!1);

1150 }, B = (g) => {

1151 try {

1152 if (g.setterMethod) {

1153 const S = g.setterMethod.replace(/#\w+#/g, "0");

1154 new Function(S);

1155 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ManageAllForms-BrBSYMBd.jsView on unpkg · L1153

1156 } catch {

1157 F({

1158 message: "Invalid setter method code",

1159 type: "error"

1160 });

1161 return;

1162 }

1163 b(g, f == null ? void 0 : f.uuid);

1164 }, ee = Wt({ control: E, name: "variableName" }), ce = Wt({ control: E, name: "variableType" }), Fe = Wt({ control: E, name: "setterMethod" }), Se = (g) => {

1165 if (g) {

1166 let S = [

1167 "* Note: ",

1168 "* A value must be returned for the changes to be reflected in the UI"

1169 ];

1170 return g === "DATE" && S.push("* For type (Date) return dayjs().valueOf();"), g === "DATE_AND_TIME" && S.push(

1171 "* For type (Date and Time) return dayjs().valueOf();"

1172 ), ` /**

1173 ${S.join(`

dist/ErrorContextProvider-BnLUtXr3.jsView file

•path = dist/ErrorContextProvider-BnLUtXr3.js kind = oversized_source_file sizeBytes = 2735938 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ErrorContextProvider-BnLUtXr3.jsView on unpkg