@calcit/editor@0.9.15: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@calcit/editor@0.9.15: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

js-out/app.util.compile.mjsView file

Lines 1-30javascript

1

2import * as $clt from "./calcit.core.mjs";

3import * as $app_DOT_config from "./app.config.mjs";

4import { db__GT_string } from "./app.util.mjs";

5import { extract_examples_code } from "./app.util.mjs";

6import { file__GT_cirru } from "./app.util.mjs";

7import { hide_empty_fields } from "./app.util.mjs";

8import { now_$x_ } from "./app.util.mjs";

9import { tree__GT_cirru } from "./app.util.mjs";

10import chalk from "chalk";

11import * as $child_process from "child_process";

12import crypto from "crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

js-out/app.util.compile.mjsView on unpkg · L10

13import * as $fs from "fs";

14import * as $path from "path";

15const _t_ = $clt.init_tags(["about","added","added-defs","changed","changed-defs","code","configs","defs","entries","error","exp-code","files","init-fn","modules"

16

17export function handle_calcit_files_$x_(pkg, old_files, latest_files, added_names, removed_names, changed_names, configs, entries, filter_ns) {

18if (arguments.length !== 9) throw $clt._args_throw('handle-calcit-files!', 9, arguments.length);

19let new_files = ($clt.some_$q_(filter_ns) ? (function _fn_(){

20 let target = $clt.get(latest_files, filter_ns);

21

22 if ($clt.some_$q_(target)) { return $clt.assoc(old_files, filter_ns, target) } else { return $clt.dissoc(old_files, filter_ns) }

23})() : latest_files);

24let calcit_data = (function _fn_(){

25 let tmp_AUTO_1 = (function _fn_(){

26 let tmp_AUTO_2 = $clt.option_$o_unwrap_or($clt.get(configs, _t_["init-fn"]), null);

27 let tmp_AUTO_3 = $clt.option_$o_unwrap_or($clt.get(configs, _t_["reload-fn"]), null);

28 let tmp_AUTO_4 = $clt.option_$o_unwrap_or($clt.get(configs, _t_.modules), null);

29 let tmp_AUTO_5 = $clt.option_$o_unwrap_or($clt.get(configs, _t_.version), null);

30 return $clt._$n__$M_(_t_["init-fn"], tmp_AUTO_2, _t_["reload-fn"], tmp_AUTO_3, _t_.modules, tmp_AUTO_4, _t_.version, tmp_AUTO_5);

.yarn/install-state.gzView file

•path = .yarn/install-state.gz kind = high_entropy_blob sizeBytes = 165925 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = payload_in_excluded_dir sizeBytes = 165925 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = compressed_blob sizeBytes = 165925 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.yarn/install-state.gzView on unpkg

dist/assets/index-Dh_hXiQR.jsView file

37409function get_gemini_key_$x_() { if (arguments.length !== 0) throw _args_throw("get-gemini-key!", 0, arguments.length); let key = localStorage.getItem("gemini-key"); if (blank_$q_(key)) { let v = prompt(str("Required", "gemini-key", "in", "localStorage")); blank_$q_(v) && (function _fn_() { let err_AUTO_7 = /* @__PURE__ */ new Error(/* @__PURE__ */ new Error("key is empty")); err_AUTO_7.data = null; throw err_AUTO_7; })(); localStorage.setItem("gemini-key", v); return v;

Medium

Ai Review Evidence

AI feature stores a user-entered Gemini key in browser localStorage.

dist/assets/index-Dh_hXiQR.jsView on unpkg · L37409