@cdnshell/loader: Suspicious npm security report (Warn)

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 4.27 MB of source, external domains: www.w3.org

Source & flagged code

1 flagged

theme-new.min.jsView file

166contains invisible/control Unicode U+034F (combining grapheme joiner) Ae(�^(�.&��C�T5�ys��w��i ��{-�K�%`�C�m�s�Ж@DX��v�u�)�خ��K�=Z4�t��Z�>�H?��f�(8�M��@��K6��7�5W3r""|�YWi�K��D5�@�0wM�j�8g�r��n;UH��7��,��kD�W��,�:4L��J @̽Qo!wh�h;uo��D��&o!`\M�+G�3�Ȭ�< �*�m�5�WsيX�?%q>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

theme-new.min.jsView on unpkg · L166

Source & flagged code

1 flagged · loading source

theme-new.min.jsView file

166contains invisible/control Unicode U+034F (combining grapheme joiner) Ae(�^(�.&��C�T5�ys��w��i ��{-�K�%`�C�m�s�Ж@DX��v�u�)�خ��K�=Z4�t��Z�>�H?��f�(8�M��@��K6��7�5W3r""|�YWi�K��D5�@�0wM�j�8g�r��n;UH��7��,��kD�W��,�:4L��J @̽Qo!wh�h;uo��D��&o!`\M�+G�3�Ȭ�< �*�m�5�WsيX�?%q>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

theme-new.min.jsView on unpkg · L166

Findings

1 Critical1 High2 Medium3 Low

CriticalTrojan Source Unicodetheme-new.min.js

HighObfuscated

MediumNetwork

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowUrl Strings