registry / @chenyomi/leafer-htmltext-edit / 2.6.12

@chenyomi/leafer-htmltext-edit@2.6.12

A text editor plugin for Leafer UI with HTML text support

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 713 KB of source, external domains: www.w3.org

Source & flagged code

2 flagged

dist/index.cjsView file

Lines 18-58javascript

18`;if(F=="18")return n+"GeneralizedTime "+rt(s(l,e))+`

19`;if(F=="1a")return n+"VisualString '"+rt(s(l,e))+`'

20`;if(F=="1e")return n+"BMPString '"+Gr(s(l,e))+`'

21`;if(F=="30"){if(l.substr(e,4)=="3000")return n+`SEQUENCE {}

22`;var h=n+`SEQUENCE

23`,p=o(l,e),S=r;if((p.length==2||p.length==3)&&l.substr(p[0],2)=="06"&&l.substr(p[p.length-1],2)=="04"){var d=i.oidname(s(l,p[0])),E=JSON.parse(JSON.stringify(r));E.x509ExtName=d,S=E;}for(var w=0;w<p.length;w++)h=h+a(l,S,p[w],n+" ");return h}if(F=="31"){for(var h=n+`SET

24`,p=o(l,e),w=0;w<p.length;w++)h=h+a(l,r,p[w],n+" ");return h}var F=parseInt(F,16);if((F&128)!=0){var N=F&31;if((F&32)!=0){for(var h=n+"["+N+`]

25`,p=o(l,e),w=0;w<p.length;w++)h=h+a(l,r,p[w],n+" ");return h}else {var v=s(l,e);if(j.isASN1HEX(v)){var h=n+"["+N+`]

26`;return h=h+a(v,r,0,n+" "),h}else (v.substr(0,8)=="68747470"||r.x509ExtName==="subjectAltName"&&N==2)&&(v=rt(v));var h=n+"["+N+"] "+v+`

27`;return h}}return n+"UNKNOWN("+F+") "+s(l,e)+`

28`};j.parse=function(t){var r=j,e=r.parse,n=r.isASN1HEX,i=r.getV,s=r.getTLV,a=r.getChildIdx,o=u.asn1,l=o.ASN1Util.oidHexToInt,c=o.x509.OID.oid2name,g=rt,v=Gr,h=zo,f={"0c":"utf8str",12:"numstr",13:"prnstr",14:"telstr",16:"ia5str",17:"utctime",18:"gentime","1a":"visstr","1e":"bmpstr",30:"seq",31:"set"},m=function(b){for(var T=[],A=a(b,0),D=0;D<A.length;D++){var H=A[D],I=s(b,H),C=e(I);T.push(C);}return T},d=t.substr(0,2),y={},p=i(t,0);if(d=="01")return t=="0101ff"?{bool:true}:{bool:false};if(d=="02")return {int:{hex:p}};if(d=="03")try{if(p.substr(0,2)!="00")throw "not encap";var S=p.substr(2);if(! ...

29`),t=t.replace(/\s+$/,""),t}function An(t){var r=t.replace(/[^0-9A-Za-z\/+=]*/g,""),e=ye(r);return e}function Wo(t,r){return

30`+hr(t,64)+`\r

31-----END `+r+`-----\r

32`}function Et(t,r){return "-----BEGIN "+r+`-----\r

33`+hr(_r(t),64)+`\r

34-----END `+r+`-----\r

35`}function ft(t,r){if(t.indexOf("-----BEGIN ")==-1)throw new Error("can't find PEM header");return r!==void 0?(t=t.replace(new RegExp("^[^]*-----BEGIN "+r+"-----"),""),t=

36`),t}function eu(t){return t=t.replace(/\r\n/mg,`

37`),t=t.replace(/\n/mg,`\r

38`),t}u.lang.String.isInteger=function(t){return t.match(/^[0-9]+$/)?true:!!t.match(/^-[0-9]+$/)};u.lang.String.isHex=function(t){return Cn(t)};function Cn(t){return !!(t.length%2==0&&(t.match(/^[0-9a-f]+$/)||t.match(/^[0-9A-F]+$/)))}u.lang.String.isBase64=function(t){return t=t.replace(/\s+/g,""),!!(t.match(/^[0-9A-Za-z+\/]+={0,3}$/)&&t.length%4==0)};u.lang.String.isBase64URL=function(t){return t.match(/[+/=]/)?false:(t=ke(t),u.lang.String.isBase64(t))};function Xr(t){return !!t.match(/^[0-9A-Za-z-_.]+$/)}u.lang.String.isIntegerArray=function(t){return t=t.replace(/\s+/g,""),!!t.match(/^\[[0-9 ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L38

39\r

40`)!=-1&&(E=d.indexOf(`\r

41\r

42`),w=2),d.indexOf(`

44`)!=-1&&(E=d.indexOf(`

46`),w=1);var F=d.indexOf("-----END");if(E!=-1&&F!=-1){var N=d.substring(E+w*2,F-w);N=N.replace(/\s+/g,

47`),T="-----BEGIN "+d+` PRIVATE KEY-----\r

48`;return T+=`Proc-Type: 4,ENCRYPTED\r

49`,T+="DEK-Info: "+S+","+E+`\r

50`,T+=`\r

51`,T+=b,T+=`\r

52-----END `+d+` PRIVATE KEY-----\r

53`,T},getEncryptedPKCS8PEM:function(d,y,p){var S=this.getEncryptedPKCS8Hex(d,y,p);return Et(S,"ENCRYPTED PRIVATE KEY")},getEncryptedPKCS8Hex:function(d,y,p){var S;p==null||p==null?S={}:S=JSON.parse(JSON.stringify(p)),S.plain=d,this.initPBES2Param(S),this.encryptPBES2Param(S,y);var E=this.generatePBES2ASN1Param(S);return u.asn1.ASN1Util.newObject(E).tohex()},initPBES2Param:function(d){if(it(d,"encalg")==null&&(d.encalg="aes256-CBC"),it(d,"iter")==null&&(d.iter=2048),it(d,"prf")==null&&(d.prf="hmacWithSHA256"),it(d,"salt")==null&&(d.salt=M.enc.Hex.stringify(M.lib.WordArray.random(8))),it(d,"enciv ...

54`,ht=yt.array,xt=0;xt<ht.length;xt++){var G=ht[xt];if(G.dn!=null&&(Y+=lt+"dn: "+G.dn.str+st),G.ip!=null&&(Y+=lt+"ip: "+G.ip+st),

55`,ht.array!==void 0)for(var xt=0;xt<ht.array.length;xt++){var G=ht.array[xt];G.cps!==void 0&&(Y+=" cps: "+G.cps+`

56`);}}return Y},T=function(yt){for(var Y="",lt=yt.array,st=0;st<lt.length;st++){var ht=lt[st];try{ht.dpname.full[0].uri!==void 0&&(Y+=" "+ht.dpname.full[0].uri+

57`);}catch{}try{ht.dname.full[0].dn.hex!==void 0&&(Y+=" "+U.hex2dn(ht.dpname.full[0].dn.hex)+`

58`);}catch{}}return Y},A=function(yt){for(var Y="",lt=yt.array,st=0;st<lt.length;st++){var ht=lt[st];ht.caissuer!==void 0&&(Y+=" caissuer: "+ht.caissuer+`

Long lines were clipped for display.

dist/index.mjsView file

Lines 18-58javascript

18`;if(F=="18")return n+"GeneralizedTime "+rt(s(l,e))+`

19`;if(F=="1a")return n+"VisualString '"+rt(s(l,e))+`'

20`;if(F=="1e")return n+"BMPString '"+Gr(s(l,e))+`'

21`;if(F=="30"){if(l.substr(e,4)=="3000")return n+`SEQUENCE {}

22`;var h=n+`SEQUENCE

24`,p=o(l,e),w=0;w<p.length;w++)h=h+a(l,r,p[w],n+" ");return h}var F=parseInt(F,16);if((F&128)!=0){var N=F&31;if((F&32)!=0){for(var h=n+"["+N+`]

25`,p=o(l,e),w=0;w<p.length;w++)h=h+a(l,r,p[w],n+" ");return h}else {var v=s(l,e);if(j.isASN1HEX(v)){var h=n+"["+N+`

Source & flagged code

2 flagged · loading source

dist/index.cjsView file

38patternName = generic_password severity = medium line = 38 matchedText = `),t}u.l...(`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L38

dist/index.mjsView file

38patternName = generic_password severity = medium line = 38 matchedText = `),t}u.l...(`\r

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L38

Findings

3 Medium6 Low

MediumSecret Patterndist/index.cjs

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.mjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/index.cjsView file

Lines 18-58javascript

18`;if(F=="18")return n+"GeneralizedTime "+rt(s(l,e))+`

19`;if(F=="1a")return n+"VisualString '"+rt(s(l,e))+`'

20`;if(F=="1e")return n+"BMPString '"+Gr(s(l,e))+`'

21`;if(F=="30"){if(l.substr(e,4)=="3000")return n+`SEQUENCE {}

22`;var h=n+`SEQUENCE

24`,p=o(l,e),w=0;w<p.length;w++)h=h+a(l,r,p[w],n+" ");return h}var F=parseInt(F,16);if((F&128)!=0){var N=F&31;if((F&32)!=0){for(var h=n+"["+N+`]

25`,p=o(l,e),w=0;w<p.length;w++)h=h+a(l,r,p[w],n+" ");return h}else {var v=s(l,e);if(j.isASN1HEX(v)){var h=n+"["+N+`]

26`;return h=h+a(v,r,0,n+" "),h}else (v.substr(0,8)=="68747470"||r.x509ExtName==="subjectAltName"&&N==2)&&(v=rt(v));var h=n+"["+N+"] "+v+`

27`;return h}}return n+"UNKNOWN("+F+") "+s(l,e)+`

29`),t=t.replace(/\s+$/,""),t}function An(t){var r=t.replace(/[^0-9A-Za-z\/+=]*/g,""),e=ye(r);return e}function Wo(t,r){return

30`+hr(t,64)+`\r

31-----END `+r+`-----\r

32`}function Et(t,r){return "-----BEGIN "+r+`-----\r

33`+hr(_r(t),64)+`\r

34-----END `+r+`-----\r

35`}function ft(t,r){if(t.indexOf("-----BEGIN ")==-1)throw new Error("can't find PEM header");return r!==void 0?(t=t.replace(new RegExp("^[^]*-----BEGIN "+r+"-----"),""),t=

36`),t}function eu(t){return t=t.replace(/\r\n/mg,`

37`),t=t.replace(/\n/mg,`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L38

39\r

40`)!=-1&&(E=d.indexOf(`\r

41\r

42`),w=2),d.indexOf(`

44`)!=-1&&(E=d.indexOf(`

46`),w=1);var F=d.indexOf("-----END");if(E!=-1&&F!=-1){var N=d.substring(E+w*2,F-w);N=N.replace(/\s+/g,

47`),T="-----BEGIN "+d+` PRIVATE KEY-----\r

48`;return T+=`Proc-Type: 4,ENCRYPTED\r

49`,T+="DEK-Info: "+S+","+E+`\r

50`,T+=`\r

51`,T+=b,T+=`\r

52-----END `+d+` PRIVATE KEY-----\r

54`,ht=yt.array,xt=0;xt<ht.length;xt++){var G=ht[xt];if(G.dn!=null&&(Y+=lt+"dn: "+G.dn.str+st),G.ip!=null&&(Y+=lt+"ip: "+G.ip+st),

55`,ht.array!==void 0)for(var xt=0;xt<ht.array.length;xt++){var G=ht.array[xt];G.cps!==void 0&&(Y+=" cps: "+G.cps+`

56`);}}return Y},T=function(yt){for(var Y="",lt=yt.array,st=0;st<lt.length;st++){var ht=lt[st];try{ht.dpname.full[0].uri!==void 0&&(Y+=" "+ht.dpname.full[0].uri+

57`);}catch{}try{ht.dname.full[0].dn.hex!==void 0&&(Y+=" "+U.hex2dn(ht.dpname.full[0].dn.hex)+`

58`);}catch{}}return Y},A=function(yt){for(var Y="",lt=yt.array,st=0;st<lt.length;st++){var ht=lt[st];ht.caissuer!==void 0&&(Y+=" caissuer: "+ht.caissuer+`

Long lines were clipped for display.

dist/index.mjsView file

Lines 18-58javascript

18`;if(F=="18")return n+"GeneralizedTime "+rt(s(l,e))+`

19`;if(F=="1a")return n+"VisualString '"+rt(s(l,e))+`'

20`;if(F=="1e")return n+"BMPString '"+Gr(s(l,e))+`'

21`;if(F=="30"){if(l.substr(e,4)=="3000")return n+`SEQUENCE {}

22`;var h=n+`SEQUENCE

24`,p=o(l,e),w=0;w<p.length;w++)h=h+a(l,r,p[w],n+" ");return h}var F=parseInt(F,16);if((F&128)!=0){var N=F&31;if((F&32)!=0){for(var h=n+"["+N+`]

25`,p=o(l,e),w=0;w<p.length;w++)h=h+a(l,r,p[w],n+" ");return h}else {var v=s(l,e);if(j.isASN1HEX(v)){var h=n+"["+N+`