Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@bendyline/squisq-react: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 10 finding(s) warrant review before installing.

View on npm All versions

registry / @bendyline/squisq-react / 2.4.0

@bendyline/squisq-react@2.4.0

React component library for doc playback, block rendering, and media layers

Static Scan Results

scanned 20h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 2.99 MB of source, external domains: html.spec.whatwg.org, server.arcgisonline.com, tile.openstreetmap.org, tile.opentopomap.org, tiles.stadiamaps.com, www.ibm.com, www.w3.org

Oversized source lightweight scan

dist/squisq-player.full.global.js4.53 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStrings

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Minified

UrlStrings

server.arcgisonline.com

tile.openstreetmap.org

tile.opentopomap.org

tiles.stadiamaps.com

www.w3.org

Source & flagged code

2 flagged · loading source

dist/chunk-WLUZTUNZ.jsView file

17package = @bendyline/squisq-react; repositoryIdentity = squisq; dependency = mermaid L17: if (!mermaidPromise) { L18: mermaidPromise = import("mermaid").then(({ default: mermaid }) => mermaid).catch((error) => { L19: mermaidPromise = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-WLUZTUNZ.jsView on unpkg · L17

dist/squisq-player.full.global.jsView file

•path = dist/squisq-player.full.global.js kind = oversized_source_file sizeBytes = 4753406 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/squisq-player.full.global.jsView on unpkg

Findings

2 High4 Medium4 Low

HighCopied Package Dependency Bridgedist/chunk-WLUZTUNZ.js

HighOversized Source Filedist/squisq-player.full.global.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

AuthorBendyline

Maintainersbendylinesupport

Version2.4.0

PublishedJul 19, 2026

LicenseMIT

Dependencies4

Integrityverified

Package size2.01 MB

Files36

Keywordsreactdoc-playerblock-renderersvganimationvideo

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.jstypes → ./dist/index.d.tsexports map

Runtimenode >=22.14.0

Artifact7.60 MB · 36 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, build:esm, build:standalone, dev +1

Behavioral surface

ChildProcessEnvironmentVarsNetworkHighEntropyStringsMinifiedObfuscatedProtestwareUrlStringsManifest: clean

LPM CLI

Source & flagged code

2 flagged

dist/chunk-WLUZTUNZ.jsView file

Lines 1-37javascript

1// src/mermaid/MermaidDiagram.tsx

2import { useEffect, useState } from "react";

3import { DEFAULT_THEME as DEFAULT_THEME2 } from "@bendyline/squisq/doc";

4

5// src/mermaid/mermaidRuntime.ts

6import { buildMermaidThemeVariables } from "@bendyline/squisq/schemas";

7import { DEFAULT_THEME } from "@bendyline/squisq/doc";

8var mermaidPromise = null;

9var MERMAID_BASE_CONFIG = {

10 startOnLoad: false,

11 securityLevel: "strict",

12 suppressErrorRendering: true,

13 deterministicIds: false,

14 logLevel: "error"

15};

16async function loadMermaid() {

17 if (!mermaidPromise) {

18 mermaidPromise = import("mermaid").then(({ default: mermaid }) => mermaid).catch((error) => {

19 mermaidPromise = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-WLUZTUNZ.jsView on unpkg · L17

20 throw error;

21 });

22 }

23 return mermaidPromise;

24}

25function enqueue(run) {

26 const host = globalThis;

27 const previous = host.__squisqMermaidWorkQueue ?? Promise.resolve();

28 const result = previous.then(run, run);

29 host.__squisqMermaidWorkQueue = result.then(

30 () => void 0,

31 () => void 0

32 );

33 return result;

34}

35function renderMermaidSvg(id, source, container, theme = DEFAULT_THEME) {

36 return enqueue(async () => {

37 const mermaid = await loadMermaid();

dist/squisq-player.full.global.jsView file

•path = dist/squisq-player.full.global.js kind = oversized_source_file sizeBytes = 4753406 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/squisq-player.full.global.jsView on unpkg