registry / @bigduu/lotus / 2026.7.7

@bigduu/lotus@2026.7.7

Standalone Lotus frontend assets for Bodhi shell and web runtime.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 79 file(s), 7.77 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, bit.ly, cdnjs.cloudflare.com, chevrotain.io, docs.expo.dev, en.wikipedia.org, fb.me, generativelanguage.googleapis.com, github.com, help.openai.com, jquery.org, jspdf.default.namespaceuri, langium.org, lodash.com, openjsf.org, opensource.org, proxy.example.com, reactjs.org, tinyurl.com, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

5 flagged

dist/assets/index-BUO2Zcn6.jsView file

Lines 1-22javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./index-Cur8quEC.js","./vendor-markdown-CARODNj-.js","./vendor-i18n-Dm-c3D_C.js","./vendor-antd-C-pjKgeW.js","./App-CH_iNVyb.js","./vendor-mermaid-BWwfm-Vj.js","./main-bnHa9vH1.js","./main-B6snAd4S.css","./App-xovo7L2Z.css"])))=>i.map(i=>d[i]);

2var mn=Object.defineProperty;var pn=(e,s,a)=>s in e?mn(e,s,{enumerable:!0,configurable:!0,writable:!0,value:a}):e[s]=a;var la=(e,s,a)=>pn(e,typeof s!=

3`," "],placeholder:e("settings.providerTab.responsesOnlyModelsPlaceholder"),allowClear:!0})}),Oo=e=>Array.isArray(e)?e.map(s=>typeof s=="string"?s.trim():"").filter(s=>!!s):[],No=({type:e})=>{const{t:s}=ae();if(!e)return null;switch(e){case"openai":return t.jsxs(t.Fragment,{children:[t.jsx(y.Item,{name:"api_key",label:s("settings.providerTab.openaiApiKey"),rules:[{required:!0,message:s("settings.providerTab.openaiApiKeyRequired")}],children:t.jsx(H.Password,{placeholder:s("settings.providerTab.openaiApiKeyPlaceholder","sk-..."),prefix:t.jsx(xt,{})})}),t.jsx(y.Item,{name:"base_url",label:s("set ...

4 "common": {

5 "headers": {

6 "x-request-id": { "type": "generated", "generator": "uuid" },

7 "x-tenant": { "type": "env_ref", "name": "TENANT_ID" }

8 }

9 },

10 "rules": [

11 {

12 "model_pattern": "gpt-5*",

13 "scope": {

14 "body_patch": [

15 { "path": "metadata.trace_id", "op": "set", "value": { "type": "generated", "generator": "uuid" } }

16 ]

17 }

18 }

19 ]

20}`,style:{fontFamily:"SFMono-Regular, Menlo, Monaco, Consolas, monospace"}})})},Rs=_=>{switch(_){case"openai":return t.jsxs(t.Fragment,{children:[t.jsx(y.Item,{name:["providers","openai","api_key"],label:e("settings.providerTab.openaiApiKey"),rules:[{required:!0,message:e("settings.providerTab.openaiApiKeyRequired")}],children:t.jsx(H.Password,{"data-testid":"api-key-input",placeholder:e("settings.providerTab.openaiApiKeyPlaceholder","sk-..."),prefix:t.jsx(xt,{})})}),t.jsx(y.Item,{name:["providers","openai","base_url"],label:e("settings.providerTab.baseUrlOptional"),extra:e("settings.providerT ...

21`," "]})}),t.jsx(Le,{dashed:!0}),bt("openai")]});case"anthropic":return t.jsxs(t.Fragment,{children:[t.jsx(y.Item,{name:["providers","anthropic","api_key"],label:e("settings.providerTab.anthropicApiKey"),rules:[{required:!0,message:e("settings.providerTab.anthropicApiKeyRequired")}],children:t.jsx(Ha,{placeholder:e("settings.providerTab.anthropicApiKeyPlaceholder","sk-ant-..."),prefix:t.jsx(xt,{})})}),t.jsx(y.Item,{name:["providers","anthropic","base_url"],label:e("settings.providerTab.baseUrlOptional"),extra:e("settings.providerTab.anthropicBaseUrlHelp"),children:t.jsx(H,{placeholder:e("setti ...

22`," "]})}),t.jsx(Le,{dashed:!0}),bt("copilot"),t.jsxs(Ws,{type:"secondary",children:[e("settings.providerTab.copilotUsageTitle"),t.jsxs("ul",{style:{marginTop:8,marginBottom:0},children:[t.jsx("li",{children:e("settings.providerTab.copilotUsageStep1")}),t.jsx("li",{children:e("settings.providerTab.copilotUsageStep2")}),t.jsx("li",{children:e("settings.providerTab.copilotUsageStep3")})]})]})]});case"bodhi":return t.jsxs(t.Fragment,{children:[t.jsx(y.Item,{name:["providers","bodhi","api_key"],label:e("settings.providerTab.bodhiApiKey"),rules:[{required:!0,message:e("settings.providerTab.apiKeyRe ...

Long lines were clipped for display.

dist/assets/vendor-markdown-CARODNj-.jsView file

40`);F.forEach(function(T,C){var x=r&&d.length+i,R={type:"text",value:"".concat(T,` L41: `)};if(C===0){var O=c.slice(g+1,p).concat(Dt({children:[R],className:A.properties.className})),U=S(O,x);d.push(U)}else if(C===F.length-1){var q=c[p+1]&&c[p+1].children&&c[p+1].chil... L42: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-markdown-CARODNj-.jsView on unpkg · L40

dist/assets/en-US-BHmVs299.jsView file

Lines 1-4javascript

1const e={translation:{app:{loading:"Loading...",retry:"Retry",backendNotReachable:"Backend not reachable at {{baseUrl}} (last error: {{message}})",errorBoundary:{title:"Something went wrong",description:"An unexpected error occurred in this section. You can try again or reload the page if the issue persists.",tryAgain:"Try Again",showDetails:"Show Details",hideDetails:"Hide Details"},passwordGate:{title:"Enter Access Password",description:"Password verification is required before entering the application.",passwordLabel:"Access Password",passwordPlaceholder:"Enter access password",submit:"Veri ...

dist/assets/main-bnHa9vH1.jsView file

Lines 1-9javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./App-CH_iNVyb.js","./vendor-markdown-CARODNj-.js","./vendor-i18n-Dm-c3D_C.js","./vendor-antd-C-pjKgeW.js","./vendor-mermaid-BWwfm-Vj.js","./App-xovo7L2Z.css"])))=>i.map(i=>d[i]);

2import

Source & flagged code

5 flagged · loading source

dist/assets/index-BUO2Zcn6.jsView file

2patternName = private_key_openssh severity = critical line = 2 matchedText = var mn=O... ",`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/index-BUO2Zcn6.jsView on unpkg · L2

2patternName = private_key_openssh severity = critical line = 2 matchedText = var mn=O... ",`

Critical

Secret Pattern

OpenSSH private key in dist/assets/index-BUO2Zcn6.js

dist/assets/index-BUO2Zcn6.jsView on unpkg · L2

dist/assets/vendor-markdown-CARODNj-.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-markdown-CARODNj-.jsView on unpkg · L40

dist/assets/en-US-BHmVs299.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = const e=...itle

Medium

Secret Pattern

Hardcoded password in dist/assets/en-US-BHmVs299.js

dist/assets/en-US-BHmVs299.jsView on unpkg · L1

dist/assets/main-bnHa9vH1.jsView file

4patternName = generic_password severity = medium line = 4 matchedText = यहां वर्...flux

Medium

Secret Pattern

Hardcoded password in dist/assets/main-bnHa9vH1.js

dist/assets/main-bnHa9vH1.jsView on unpkg · L4

Findings

2 Critical7 Medium7 Low

CriticalCritical Secretdist/assets/index-BUO2Zcn6.js

CriticalSecret Patterndist/assets/index-BUO2Zcn6.js

MediumDynamic Requiredist/assets/vendor-markdown-CARODNj-.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/assets/en-US-BHmVs299.js

MediumSecret Patterndist/assets/main-bnHa9vH1.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/assets/index-BUO2Zcn6.jsView file

Lines 1-22javascript

2var mn=Object.defineProperty;var pn=(e,s,a)=>s in e?mn(e,s,{enumerable:!0,configurable:!0,writable:!0,value:a}):e[s]=a;var la=(e,s,a)=>pn(e,typeof s!=

4 "common": {

5 "headers": {

6 "x-request-id": { "type": "generated", "generator": "uuid" },

7 "x-tenant": { "type": "env_ref", "name": "TENANT_ID" }

8 }

9 },

10 "rules": [

11 {

12 "model_pattern": "gpt-5*",

13 "scope": {

14 "body_patch": [

15 { "path": "metadata.trace_id", "op": "set", "value": { "type": "generated", "generator": "uuid" } }

16 ]

17 }

18 }

19 ]

Long lines were clipped for display.

dist/assets/vendor-markdown-CARODNj-.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-markdown-CARODNj-.jsView on unpkg · L40

dist/assets/en-US-BHmVs299.jsView file

Lines 1-4javascript

dist/assets/main-bnHa9vH1.jsView file

Lines 1-9javascript

2import