registry / @bigduu/lotus / 2026.7.21

@bigduu/lotus@2026.7.21

Standalone Lotus frontend assets for Bodhi shell and web runtime.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 66 file(s), 7.36 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.day.app, api.deepseek.com, api.minimax.io, api.minimaxi.com, api.moonshot.cn, api.openai.com, api.z.ai, bit.ly, cdnjs.cloudflare.com, chevrotain.io, dashscope.aliyuncs.com, docs.expo.dev, en.wikipedia.org, example.com, fb.me, generativelanguage.googleapis.com, github.com, help.openai.com, jquery.org, jspdf.default.namespaceuri, langium.org, lodash.com, ntfy.sh, open.bigmodel.cn, openjsf.org, opensource.org, proxy.example.com, reactjs.org, tinyurl.com, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

6 flagged

dist/assets/SystemSettingsPage-alDevC06.jsView file

Lines 1-22javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./MetricsService-BxrS11_V.js","./vendor-markdown-A4vmMV1q.js","./vendor-i18n-Dm-c3D_C.js","./vendor-mermaid-Dgz08Kou.js","./vendor-antd-BGUdY6EA.js","./main-ONDVyWz8.js","./main-B6snAd4S.css","./MetricsService-obKcPPfm.css"])))=>i.map(i=>d[i]);

2var $a=Object.defineProperty;var Va=(e,s,n)=>s in e?$a(e,s,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[s]=n;var

3`," "],placeholder:e("settings.providerTab.responsesOnlyModelsPlaceholder"),allowClear:!0})}),Vl=e=>Array.isArray(e)?e.map(s=>typeof s=="string"?s.trim():"").filter(s=>!!s):[],ql=`{

4 "common": {

5 "headers": {

6 "x-request-id": { "type": "generated", "generator": "uuid" },

7 "x-tenant": { "type": "env_ref", "name": "TENANT_ID" }

8 }

9 },

10 "rules": [

11 {

12 "model_pattern": "gpt-5*",

13 "scope": {

14 "body_patch": [

15 { "path": "metadata.trace_id", "op": "set", "value": { "type": "generated", "generator": "uuid" } }

16 ]

17 }

18 }

19 ]

20}`,os=e=>t.jsxs(t.Fragment,{children:[t.jsx(we,{dashed:!0}),t.jsx(S.Item,{name:"request_overrides_json",label:e("settings.providerTab.advancedRequestOverrides"),extra:t.jsxs(L,{direction:"vertical",size:4,children:[t.jsx(tt,{type:"secondary",children:e("settings.providerTab.advancedRequestOverridesHelp")}),t.jsxs(tt,{type:"secondary",children:[e("settings.providerTab.envVarInjection")," ",t.jsx(tt,{code:!0,children:'{ "type": "env_ref", "name": "YOUR_ENV_NAME" }'})]})]}),children:t.jsx(U.TextArea,{autoSize:{minRows:6,maxRows:16},placeholder:ql,style:{fontFamily:"SFMono-Regular, Menlo, Monaco, ...

21 "common": {

22 "headers": {

Long lines were clipped for display.

dist/assets/cytoscape.esm-BiciSPf8.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/cytoscape.esm-BiciSPf8.jsView on unpkg

dist/assets/main-ONDVyWz8.jsView file

Lines 1-13javascript

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code