registry  /  @bigduu/lotus  /  2026.7.2

@bigduu/lotus@2026.7.2

Standalone Lotus frontend assets for Bodhi shell and web runtime.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 78 file(s), 7.75 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, bit.ly, cdnjs.cloudflare.com, chevrotain.io, docs.expo.dev, en.wikipedia.org, fb.me, generativelanguage.googleapis.com, github.com, help.openai.com, jquery.org, jspdf.default.namespaceuri, langium.org, lodash.com, openjsf.org, opensource.org, proxy.example.com, reactjs.org, tinyurl.com, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

3 flagged · loading source
dist/assets/en-US-BtbJ8Hj4.jsView file
1patternName = generic_password severity = medium line = 1 matchedText = const e=...itle
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/assets/en-US-BtbJ8Hj4.jsView on unpkg · L1
dist/assets/vendor-markdown-teEfNS9t.jsView file
40`);F.forEach(function(T,C){var x=r&&d.length+i,R={type:"text",value:"".concat(T,` L41: `)};if(C===0){var O=c.slice(g+1,p).concat(Dt({children:[R],className:A.properties.className})),U=S(O,x);d.push(U)}else if(C===F.length-1){var q=c[p+1]&&c[p+1].children&&c[p+1].chil... L42: ?|
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-markdown-teEfNS9t.jsView on unpkg · L40
dist/assets/main-B84X-s86.jsView file
4patternName = generic_password severity = medium line = 4 matchedText = यहां वर्...flux
Medium
Secret Pattern

Hardcoded password in dist/assets/main-B84X-s86.js

dist/assets/main-B84X-s86.jsView on unpkg · L4

Findings

7 Medium7 Low
MediumSecret Patterndist/assets/en-US-BtbJ8Hj4.js
MediumDynamic Requiredist/assets/vendor-markdown-teEfNS9t.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/assets/main-B84X-s86.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings