registry / @bigduu/lotus / 2026.7.15

@bigduu/lotus@2026.7.15

Standalone Lotus frontend assets for Bodhi shell and web runtime.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 62 file(s), 7.80 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.day.app, api.deepseek.com, api.minimax.io, api.minimaxi.com, api.moonshot.cn, api.openai.com, api.z.ai, bit.ly, cdnjs.cloudflare.com, chevrotain.io, dashscope.aliyuncs.com, docs.expo.dev, en.wikipedia.org, example.com, fb.me, generativelanguage.googleapis.com, github.com, help.openai.com, jquery.org, jspdf.default.namespaceuri, langium.org, lodash.com, ntfy.sh, open.bigmodel.cn, openjsf.org, opensource.org, proxy.example.com, reactjs.org, tinyurl.com, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

5 flagged

dist/assets/SystemSettingsPage-DITQ98iL.jsView file

Lines 1-22javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./MetricsService-Cncz4Wn7.js","./vendor-markdown-Bz_2-zkk.js","./vendor-i18n-Dm-c3D_C.js","./vendor-antd-IzIw5qDM.js","./vendor-mermaid-DIRrTQU1.js","./main-Bm_td6Y3.js","./main-B6snAd4S.css","./MetricsService-CPTVCb46.css"])))=>i.map(i=>d[i]);

2var Pa=Object.defineProperty;var Da=(e,s,n)=>s in e?Pa(e,s,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[s]=n;var kn=(e,s,n)=>Da(e,typeof s!=

3`," "],placeholder:e("settings.providerTab.responsesOnlyModelsPlaceholder"),allowClear:!0})}),vl=e=>Array.isArray(e)?e.map(s=>typeof s=="string"?s.trim():"").filter(s=>!!s):[],jl=({type:e,hasStoredApiKey:s})=>{const{t:n}=re();if(!e)return null;const a=i=>s?[]:[{required:!0,message:i}],r=i=>s?n("settings.providerTab.apiKeyKeepPlaceholder","Configured — leave empty to keep"):i;switch(e){case"openai":return t.jsxs(t.Fragment,{children:[t.jsx(b.Item,{name:"api_key",label:n("settings.providerTab.openaiApiKey"),rules:a(n("settings.providerTab.openaiApiKeyRequired")),children:t.jsx(B.Password,{placeh ...

4 "common": {

5 "headers": {

6 "x-request-id": { "type": "generated", "generator": "uuid" },

7 "x-tenant": { "type": "env_ref", "name": "TENANT_ID" }

8 }

9 },

10 "rules": [

11 {

12 "model_pattern": "gpt-5*",

13 "scope": {

14 "body_patch": [

15 { "path": "metadata.trace_id", "op": "set", "value": { "type": "generated", "generator": "uuid" } }

16 ]

17 }

18 }

19 ]

20}`,style:{fontFamily:"SFMono-Regular, Menlo, Monaco, Consolas, monospace"}})})},qs=T=>{const _=f.has(T),Z=J=>_?[]:[{required:!0,message:J}],K=J=>_?e("settings.providerTab.apiKeyKeepPlaceholder","Configured — leave empty to keep"):J;switch(T){case"openai":return t.jsxs(t.Fragment,{children:[t.jsx(b.Item,{name:["providers","openai","api_key"],label:e("settings.providerTab.openaiApiKey"),rules:Z(e("settings.providerTab.openaiApiKeyRequired")),children:t.jsx(B.Password,{"data-testid":"api-key-input",placeholder:K(e("settings.providerTab.openaiApiKeyPlaceholder","sk-...")),prefix:t.jsx(jt,{})})}),t ...

21`," "]})}),t.jsx(Pe,{dashed:!0}),St("openai")]});case"anthropic":return t.jsxs(t.Fragment,{children:[t.jsx(b.Item,{name:["providers","anthropic","api_key"],label:e("settings.providerTab.anthropicApiKey"),rules:Z(e("settings.providerTab.anthropicApiKeyRequired")),children:t.jsx(la,{placeholder:K(e("settings.providerTab.anthropicApiKeyPlaceholder","sk-ant-...")),prefix:t.jsx(jt,{})})}),t.jsx(b.Item,{name:["providers","anthropic","base_url"],label:e("settings.providerTab.baseUrlOptional"),extra:e("settings.providerTab.anthropicBaseUrlHelp"),children:t.jsx(B,{placeholder:e("settings.providerTab.an ...

22`," "]})}),t.jsx(Pe,{dashed:!0}),St("copilot"),t.jsxs(rn,{type:"secondary",children:[e("settings.providerTab.copilotUsageTitle"),t.jsxs("ul",{style:{marginTop:8,marginBottom:0},children:[t.jsx("li",{children:e("settings.providerTab.copilotUsageStep1")}),t.jsx("li",{children:e("settings.providerTab.copilotUsageStep2")}),t.jsx("li",{children:e("settings.providerTab.copilotUsageStep3")})]})]})]});case"bodhi":return t.jsxs(t.Fragment,{children:[t.jsx(b.Item,{name:["providers","bodhi","api_key"],label:e("settings.providerTab.bodhiApiKey"),rules:Z(e("settings.providerTab.apiKeyRequired")),children:t ...

Long lines were clipped for display.

dist/assets/vendor-markdown-Bz_2-zkk.jsView file

40`);F.forEach(function(T,C){var x=r&&d.length+i,R={type:"text",value:"".concat(T,` L41: `)};if(C===0){var O=c.slice(g+1,p).concat(Dt({children:[R],className:A.properties.className})),U=S(O,x);d.push(U)}else if(C===F.length-1){var q=c[p+1]&&c[p+1].children&&c[p+1].chil... L42: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-markdown-Bz_2-zkk.jsView on unpkg · L40

dist/assets/main-Bm_td6Y3.jsView file

Lines 1-13javascript

2import

Source & flagged code

5 flagged · loading source

dist/assets/SystemSettingsPage-DITQ98iL.jsView file

2patternName = private_key_openssh severity = critical line = 2 matchedText = var Pa=O... ",`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/SystemSettingsPage-DITQ98iL.jsView on unpkg · L2

2patternName = private_key_openssh severity = critical line = 2 matchedText = var Pa=O... ",`

Critical

Secret Pattern

OpenSSH private key in dist/assets/SystemSettingsPage-DITQ98iL.js

dist/assets/SystemSettingsPage-DITQ98iL.jsView on unpkg · L2

dist/assets/vendor-markdown-Bz_2-zkk.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-markdown-Bz_2-zkk.jsView on unpkg · L40

dist/assets/main-Bm_td6Y3.jsView file

4patternName = generic_password severity = medium line = 4 matchedText = यहां वर्...flux

Medium

Secret Pattern

Hardcoded password in dist/assets/main-Bm_td6Y3.js

dist/assets/main-Bm_td6Y3.jsView on unpkg · L4

8patternName = generic_password severity = medium line = 8 matchedText = 在這裡描述工作流...itle

Medium

Secret Pattern

Hardcoded password in dist/assets/main-Bm_td6Y3.js

dist/assets/main-Bm_td6Y3.jsView on unpkg · L8

Findings

2 Critical7 Medium7 Low

CriticalCritical Secretdist/assets/SystemSettingsPage-DITQ98iL.js

CriticalSecret Patterndist/assets/SystemSettingsPage-DITQ98iL.js

MediumDynamic Requiredist/assets/vendor-markdown-Bz_2-zkk.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/assets/main-Bm_td6Y3.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/assets/SystemSettingsPage-DITQ98iL.jsView file

Lines 1-22javascript

2var Pa=Object.defineProperty;var Da=(e,s,n)=>s in e?Pa(e,s,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[s]=n;var kn=(e,s,n)=>Da(e,typeof s!=

4 "common": {

5 "headers": {

6 "x-request-id": { "type": "generated", "generator": "uuid" },

7 "x-tenant": { "type": "env_ref", "name": "TENANT_ID" }

8 }

9 },

10 "rules": [

11 {

12 "model_pattern": "gpt-5*",

13 "scope": {

14 "body_patch": [

15 { "path": "metadata.trace_id", "op": "set", "value": { "type": "generated", "generator": "uuid" } }

16 ]

17 }

18 }

19 ]

Long lines were clipped for display.

dist/assets/vendor-markdown-Bz_2-zkk.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-markdown-Bz_2-zkk.jsView on unpkg · L40

dist/assets/main-Bm_td6Y3.jsView file

Lines 1-13javascript

2import