registry / @chayns-components/core / 5.4.5

@chayns-components/core@5.4.5

⚠ Under review

A set of beautiful React components for developing your own applications with chayns.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 528 file(s), 1.23 MB of source, external domains: api.chayns-static.space, api.chayns.net, api.whatsapp.com, cube.tobit.cloud, facebook.com, streamingservice.chayns.space, sub60.tobit.com, tapp.chayns-static.space, twitter.com, webapi.tobit.com, www.facebook.com, www.w3.org

Source & flagged code

2 flagged

lib/esm/components/mention-finder/MentionFinder.jsView file

Lines 24-64javascript

24 popupAlignment,

25 enableDragHandle = false,

26 dragCloseThresholdInPx = DRAG_CLOSE_THRESHOLD_IN_PX,

27 overlayContainerSelector

28}) => {

29 const [activeMember, setActiveMember] = useState(members[0]);

30 const [focusedIndex, setFocusedIndex] = useState(0);

31 const [shouldShowPopup, setShouldShowPopup] = useState(true);

32 const popupRef = useRef(null);

33 const listRef = useRef(null);

34 const dragStartYRef = useRef(null);

35 const hasTriggeredDragCloseRef = useRef(false);

36 const activePointerIdRef = useRef(null);

37 const activeTouchIdRef = useRef(null);

38 const [isDraggingHandle, setIsDraggingHandle] = useState(false);

39 const [dragOffset, setDragOffset] = useState(0);

40 const [dragProgress, setDragProgress] = useState(0);

41 const [overlayContainer, setOverlayContainer] = useState(null);

42 const [fullMatch, searchString] = useMemo(() => {

43 // eslint-disable-next-line no-irregular-whitespace

44 const regExpMatchArray = inputValue.match(/@(?!\s)([^\s]*)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/esm/components/mention-finder/MentionFinder.jsView on unpkg · L44

45 return [regExpMatchArray?.[0], regExpMatchArray?.[1]?.toLowerCase() ?? ''];

46 }, [inputValue]);

47 const filteredMembers = useMemo(() => searchString !== '' ? members.filter(({

48 id,

49 info,

50 name

51 }) => id.toLowerCase().includes(searchString) || info?.replace('chayns', '').toLowerCase().includes(searchString) || name.toLowerCase().includes(searchString)) : members, [members, searchString]);

52 const handleKeyDown = useCallback(event => {

53 if ((event.key === 'ArrowUp' || event.key === 'ArrowDown') && shouldRenderPopup) {

54 event.preventDefault();

55 const children = listRef.current?.children;

56 if (children && children.length > 0) {

57 const newIndex = focusedIndex !== null ? (focusedIndex + (event.key === 'ArrowUp' ? -1 : 1) + children.length) % children.length : 0;

58 if (focusedIndex !== null) {

59 const prevElement = children[focusedIndex];

60 prevElement.tabIndex = -1;

61 }

62 setFocusedIndex(newIndex);

63 const member = filteredMembers[newIndex];

64 setActiveMember(member);

lib/cjs/components/mention-finder/MentionFinder.jsView file

•Trigger-reachable chain: manifest.main -> lib/cjs/index.js -> lib/cjs/components/mention-finder/MentionFinder.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/cjs/components/mention-finder/MentionFinder.jsView on unpkg

Source & flagged code

2 flagged · loading source

lib/esm/components/mention-finder/MentionFinder.jsView file

44contains invisible/control Unicode U+200B (zero width space) const regExpMatchArray = inputValue.match(/@(?!\s)([^\s<U+200B>]*)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/esm/components/mention-finder/MentionFinder.jsView on unpkg · L44

lib/cjs/components/mention-finder/MentionFinder.jsView file

•Trigger-reachable chain: manifest.main -> lib/cjs/index.js -> lib/cjs/components/mention-finder/MentionFinder.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/cjs/components/mention-finder/MentionFinder.jsView on unpkg

Findings

2 Critical2 Medium3 Low

CriticalTrojan Source Unicodelib/esm/components/mention-finder/MentionFinder.js

CriticalTrigger Reachable Dangerous Capabilitylib/cjs/components/mention-finder/MentionFinder.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

lib/esm/components/mention-finder/MentionFinder.jsView file

Lines 24-64javascript

24 popupAlignment,

25 enableDragHandle = false,

26 dragCloseThresholdInPx = DRAG_CLOSE_THRESHOLD_IN_PX,

27 overlayContainerSelector

28}) => {

29 const [activeMember, setActiveMember] = useState(members[0]);

30 const [focusedIndex, setFocusedIndex] = useState(0);

31 const [shouldShowPopup, setShouldShowPopup] = useState(true);

32 const popupRef = useRef(null);

33 const listRef = useRef(null);

34 const dragStartYRef = useRef(null);

35 const hasTriggeredDragCloseRef = useRef(false);

36 const activePointerIdRef = useRef(null);

37 const activeTouchIdRef = useRef(null);

38 const [isDraggingHandle, setIsDraggingHandle] = useState(false);

39 const [dragOffset, setDragOffset] = useState(0);

40 const [dragProgress, setDragProgress] = useState(0);

41 const [overlayContainer, setOverlayContainer] = useState(null);

42 const [fullMatch, searchString] = useMemo(() => {

43 // eslint-disable-next-line no-irregular-whitespace

44 const regExpMatchArray = inputValue.match(/@(?!\s)([^\s]*)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/esm/components/mention-finder/MentionFinder.jsView on unpkg · L44

45 return [regExpMatchArray?.[0], regExpMatchArray?.[1]?.toLowerCase() ?? ''];

46 }, [inputValue]);

47 const filteredMembers = useMemo(() => searchString !== '' ? members.filter(({

48 id,

49 info,

50 name

51 }) => id.toLowerCase().includes(searchString) || info?.replace('chayns', '').toLowerCase().includes(searchString) || name.toLowerCase().includes(searchString)) : members, [members, searchString]);

52 const handleKeyDown = useCallback(event => {

53 if ((event.key === 'ArrowUp' || event.key === 'ArrowDown') && shouldRenderPopup) {

54 event.preventDefault();

55 const children = listRef.current?.children;

56 if (children && children.length > 0) {

57 const newIndex = focusedIndex !== null ? (focusedIndex + (event.key === 'ArrowUp' ? -1 : 1) + children.length) % children.length : 0;

58 if (focusedIndex !== null) {

59 const prevElement = children[focusedIndex];

60 prevElement.tabIndex = -1;

61 }

62 setFocusedIndex(newIndex);

63 const member = filteredMembers[newIndex];

64 setActiveMember(member);

lib/cjs/components/mention-finder/MentionFinder.jsView file

•Trigger-reachable chain: manifest.main -> lib/cjs/index.js -> lib/cjs/components/mention-finder/MentionFinder.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/cjs/components/mention-finder/MentionFinder.jsView on unpkg