registry / @coffer-org/web / 1.3.0

@coffer-org/web@1.3.0

⚠ Under review

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 155 file(s), 5.58 MB of source, external domains: base-ui.com, fb.me, github.com, html.spec.whatwg.org, json-schema.org, leafletjs.com, nominatim.openstreetmap.org, prosemirror.net, purecatamphetamine.github.io, radix-ui.com, react.dev, tile.openstreetmap.org, www.ibm.com, www.openstreetmap.org, www.w3.org

Source & flagged code

6 flagged

dist/assets/dist-CbTzBiwL.jsView file

Lines 1-13javascript

1var e=1024,t=0,n=class{constructor(e,t){this.from=e,this.to=t}},r=class{constructor(e={}){this.id=t++,this.perNode=!!e.perNode,this.deserialize=e.deserialize||(()=>{throw Error(`This node type doesn't define a deserialize function`)}),this.combine=e.combine||null}add(e){if(this.perNode)throw RangeError(`Can't add per-node props to node types`);return typeof e!=`function`&&(e=o.match(e)),t=>{let n=e(t);return n===void 0?null:[this,n]}}};r.closedBy=new r({deserialize:e=>e.split(` `)}),r.openedBy=new r({deserialize:e=>e.split(` `)}),r.group=new r({deserialize:e=>e.split(` `)}),r.isolate=new r({de ...

2`){[e,t]=Ke(this,e,t);let r=``;for(let i=0,a=0;i<=t&&a<this.text.length;a++){let o=this.text[a],s=i+o.length;i>e&&a&&(r+=n),e<

3`){[e,t]=Ke(this,e,t);let r=``;for(let i=0,a=0;i<this.children.length&&a<=t;i++){let o=this.children[i],s=a+o.length;a>e&&i&&(r+=n),e<s

4`,this;e--}else if(r instanceof w){let i=r.text[a+(t<0?-1:0)];if(this.offsets[n]+=t,i.length>Math.max(0,e))return this.value=e==0?i:t>0?i.slice(e):

5`}get readOnly(){return this.facet(jt)}phrase(t,...n){for(let n of this.facet(e.phrases))if(Object.prototype.hasOwnProperty.call(n,t)){t=n[t];break}return n.length&&(t=t.replace(/\$(\$|\d*)/g,(e,t)=>{if(t==`$`)return`$`;let r=+(t||1);return!r||r>n.length?e:n[r-1]})),t}languageDataAt(e,t,n=-1){let r=[];for(let i of this.facet(Tt))for(let a of i(this,t,n))Object.prototype.hasOwnProperty.call(a,e)&&r.push(a[e]);return r}charCategorizer(e){let t=this.languageDataAt(`wordChars`,e);return qt(t.length?t[0]:``)}wordAt(e){let{text:t,from:n,length:r}=this.doc.lineAt(e),i=this.charCategorizer(e),a=e-n,o= ...

6`)}static newName(){let e=vn[gn]||1;return vn[gn]=e+1,hn+e.toString(36)}static mount(e,t,n){let r=e[_n],i=n&&n.nonce;r?i&&r.setNonce(i):r

7`;this.styleTag.textContent=e;let n=t.head||t;this.styleTag.parentNode!=n&&n.insertBefore(this.styleTag,n.firstChild)}}setNonce(e){this.styleTag&&this.styleTag.getAttribute(`nonce`)!=e&&this.styleTag.setAttribute(`nonce`,e)}},Sn={8:`Backspace`,9:`Tab`,

8`,i=e.state.doc.line(i.number+(n?1:-1)),a=e.bidiSpans(i),t=e.visualLineSide(i,!n)}if(!c){if(!r)return t;c=r(l)}else if(!c(l))return s;s=t}}function ha(e

9 `&&e.lineWrapping&&(r&&=k.single(r.main.anchor-1,r.main.head-1),n={from:a.from,to:a.to,insert:C.of([` `])}),n)return ja(e,n,r,o);if(r&&!Ia(r,a)){let t=!1,n=`select`;return e.inputState.lastSelectionTime>Date.now()-50&&(e.inputState.lastSelectionOrigin==`select`&&(t=!0),n=e.inputState.lastSelectionOrigin,n==`select.pointer`&&(r=va(i.facet(_i).map(t=>t(e)),r))),e.dispatch({selection:r,scrollIntoView:t,userEvent:n}),!0}else return!1}function ja(e,t,n,r=-1){if(L.ios&&e.inputState.flushIOSKey(t))return!0;let i=e.state.selection.main;if(L.android&&(t.to==i.to&&(t.from==i.from||t.from==i.from-1&&e.s ...

10`))};if((L.mac||L.android)&&u.from==a-1&&/^\. ?$/.test(n.text)&&e.contentDOM.getAttribute(`autocorrect`)==`off`&&(u={from:o,to:s,insert:C.of([n.text.replace(`.`,` `)])}),this.pendingContextChange=

11--؜‎‏\u2028\u2029‭‮⁦⁧⁩￹-]`,Qs),ec={0:`null`,7:`bell`,8:`backspace`,10:`newline`,11:`vertical tab`,13:`carriage return`,27:`escape`,8203:`zero width space`,8204:`zero width non-joiner`,8205:`zero width joiner`,8206:`left-to-right mark`,8207:`right-to-left mark`,8232:`line separator

12`&&(t=``);else{let e=t.indexOf(`

13`);e>-1&&(t=t.slice(0,e))}return e+t.length<=this.to?t:t.slice(0,this.to-e)}nextLine(){let e=this.parsedPos,t=this.lineAfter(e),n=e+t.length;for(let e=this.rangeIndex;;){let r

Long lines were clipped for display.

dist/assets/index-a1UeYh9b.jsView file

76contains invisible/control Unicode U+200B (zero width space) In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function jl(e,t){if(e){if(typeof e==`string`)return Ml(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/index-a1UeYh9b.jsView on unpkg · L76

88In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function jm(e,t){if(e){if(typeof e==`string`)return Mm(e,t);var n=Object.prototype.toString.cal... L89: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ah(e,t){if(e){if(typeof e==`string`)return oh(e,t);var n=Object.prototype.toString.cal... L90: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function _h(e,t){if(e){if(typeof e==`string`)return vh(e,t);var n=Object.prototype.toString.cal... L91: Decimal separator can't be same as thousand separator. ... L101: L102: For more information, see https://radix-ui.com/primitives/docs/components/${t.docsSlug}`;return K.useEffect(()=>{e&&(document.getElementById(e)||console.error(n))},[n,e]),null},I$=... L103: ?| L104: |(?![\\s\\S])))+`,`m`),alias:i,inside:{line:{pattern:/(.)(?=[\s\S]).*(?:\r\n?|\n)?/,lookbehind:!0},prefix:{pattern:/[\s\S]/,alias:/\w+/.exec(n)[0]}}}}),Object.defineProperty(e.lang...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/index-a1UeYh9b.jsView on unpkg · L88

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/MarkdownEditor-CX6oZ_kg.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @coffer-org/web@1.2.4 matchedIdentity = npm:QGNvZmZlci1vcmcvd2Vi:1.2.4 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/MarkdownEditor-CX6oZ_kg.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/assets/dist-CbTzBiwL.jsView file

1var e=1024,t=0,n=class{constructor(e,t){this.from=e,this.to=t}},r=class{constructor(e={}){this.id=t++,this.perNode=!!e.perNode,this.deserialize=e.deserialize||(()=>{throw Error(`Th... L2: `){[e,t]=Ke(this,e,t);let r=``;for(let i=0,a=0;i<=t&&a<this.text.length;a++){let o=this.text[a],s=i+o.length;i>e&&a&&(r+=n),e<s&&t>i&&(r+=o.slice(Math.max(0,e-i),t-i)),i=s+1}return...

High

Child Process

Package source references child process execution.

dist/assets/dist-CbTzBiwL.jsView on unpkg · L1

dist/assets/index-a1UeYh9b.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/index-a1UeYh9b.jsView on unpkg · L76

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/index-a1UeYh9b.jsView on unpkg · L88

89In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ah(e,t){if(e){if(typeof e==`string`)return oh(e,t);var n=Object.prototype.toString.cal... L90: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function _h(e,t){if(e){if(typeof e==`string`)return vh(e,t);var n=Object.prototype.toString.cal... L91: Decimal separator can't be same as thousand separator.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/index-a1UeYh9b.jsView on unpkg · L89

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/MarkdownEditor-CX6oZ_kg.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/MarkdownEditor-CX6oZ_kg.jsView on unpkg

Findings

2 Critical3 High4 Medium5 Low

CriticalTrojan Source Unicodedist/assets/index-a1UeYh9b.js

CriticalPrevious Version Dangerous Deltadist/assets/MarkdownEditor-CX6oZ_kg.js

HighChild Processdist/assets/dist-CbTzBiwL.js

HighCommand Output Exfiltrationdist/assets/index-a1UeYh9b.js

HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

MediumDynamic Requiredist/assets/index-a1UeYh9b.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/assets/dist-CbTzBiwL.jsView file

Lines 1-13javascript

2`){[e,t]=Ke(this,e,t);let r=``;for(let i=0,a=0;i<=t&&a<this.text.length;a++){let o=this.text[a],s=i+o.length;i>e&&a&&(r+=n),e<

3`){[e,t]=Ke(this,e,t);let r=``;for(let i=0,a=0;i<this.children.length&&a<=t;i++){let o=this.children[i],s=a+o.length;a>e&&i&&(r+=n),e<s

4`,this;e--}else if(r instanceof w){let i=r.text[a+(t<0?-1:0)];if(this.offsets[n]+=t,i.length>Math.max(0,e))return this.value=e==0?i:t>0?i.slice(e):

6`)}static newName(){let e=vn[gn]||1;return vn[gn]=e+1,hn+e.toString(36)}static mount(e,t,n){let r=e[_n],i=n&&n.nonce;r?i&&r.setNonce(i):r

8`,i=e.state.doc.line(i.number+(n?1:-1)),a=e.bidiSpans(i),t=e.visualLineSide(i,!n)}if(!c){if(!r)return t;c=r(l)}else if(!c(l))return s;s=t}}function ha(e

10`))};if((L.mac||L.android)&&u.from==a-1&&/^\. ?$/.test(n.text)&&e.contentDOM.getAttribute(`autocorrect`)==`off`&&(u={from:o,to:s,insert:C.of([n.text.replace(`.`,` `)])}),this.pendingContextChange=

12`&&(t=``);else{let e=t.indexOf(`

13`);e>-1&&(t=t.slice(0,e))}return e+t.length<=this.to?t:t.slice(0,this.to-e)}nextLine(){let e=this.parsedPos,t=this.lineAfter(e),n=e+t.length;for(let e=this.rangeIndex;;){let r

Long lines were clipped for display.

dist/assets/index-a1UeYh9b.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/index-a1UeYh9b.jsView on unpkg · L76

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/index-a1UeYh9b.jsView on unpkg · L88

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/MarkdownEditor-CX6oZ_kg.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/MarkdownEditor-CX6oZ_kg.jsView on unpkg