@camstack/addon-model-studio@1.0.13: Suspicious npm security | LPM Firewall

Loading npm security reports…

@camstack/addon-model-studio@1.0.13: Suspicious npm security | LPM Firewall

Source & flagged code

4 flagged

dist/model-studio.addon.mjsView file

149try { L150: new Function(""); L151: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/model-studio.addon.mjsView on unpkg · L149

dist/virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_model_studio_page__remoteEntry_js-CqfX1MWB.mjsView file

Lines 888-928javascript

888 [Yt]: "The name option cannot be changed after initialization. If you want to create a new instance with a different name, please use \"createInstance\" api.",

889 [Xt]: "The remoteEntry URL is missing from the remote snapshot.",

890 [Zt]: "The getter for the shared module is not a function. This may be caused by setting \"shared.import: false\" without the host providing the corresponding lib.",

891 [Qt]: "The manifest is not a valid Module Federation manifest.",

892 [$t]: "The remote does not expose the requested module.",

893 [en]: "Remote container initialization failed."

894}, an = { [tn]: "Failed to generate type declaration. Execute the below cmd to reproduce and fix the error." }, on = {

895 [nn]: "Failed to find expose module.",

896 [rn]: "PublicPath is required in prod mode."

897};

898({

899 ...U,

900 ...an,

901 ...on

902});

903//#endregion

904//#region ../../node_modules/@module-federation/runtime-core/dist/utils/load.js

905var sn = ".then(callbacks[0]).catch(callbacks[1])";

906async function cn({ entry: e, remoteEntryExports: t }) {

907 return new Promise((n, r) => {

908 try {

909 t ? n(t) : typeof FEDERATION_ALLOW_NEW_FUNCTION < "u" ? Function("callbacks", `import("${e}")${sn}`)([n, r]) : import(

910 /* webpackIgnore: true */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_model_studio_page__remoteEntry_js-CqfX1MWB.mjsView on unpkg · L908

911 /* @vite-ignore */

912 e

913).then(n).catch(r);

914 } catch (t) {

915 b(`Failed to load ESM entry from "${e}". ${t instanceof Error ? t.message : String(t)}`);

916 }

917 });

918}

919async function ln({ entry: e, remoteEntryExports: t }) {

920 return new Promise((n, r) => {

921 try {

922 t ? n(t) : typeof __system_context__ > "u" ? System.import(e).then(n).catch(r) : Function("callbacks"

923 } catch (t) {

924 b(`Failed to load SystemJS entry from "${e}". ${t instanceof Error ? t.message : String(t)}`);

925 }

926 });

927}

928function un(e, t, n) {

python/convert_lib.pyView file

•path = python/convert_lib.py kind = build_helper sizeBytes = 4549 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/convert_lib.pyView on unpkg

python/__tests__/test_convert_lib.pyView file

•path = python/__tests__/test_convert_lib.py kind = payload_in_excluded_dir sizeBytes = 1203 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/__tests__/test_convert_lib.pyView on unpkg