registry / @conduction/theme / 1.1.71

@conduction/theme@1.1.71

Conduction's design tokens theme

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 12.2 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-31json

2 "name": "@conduction/theme",

3 "version": "1.1.71",

4 "description": "Conduction's design tokens theme",

5 "main": "index.js",

6 "repository": {

7 "type": "git",

8 "url": "git+https://codeberg.org/Conduction/conduction-theme.git"

9 },

10 "scripts": {

11 "postinstall": "npm run build",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "build": "npm-run-all build:**",

13 "build:conduction": "cd ./conduction-design-tokens && npm run build",

14 "build:almere": "cd ./municipalities/almere-design-tokens && npm run build",

15 "build:baarn": "cd ./municipalities/baarn-design-tokens && npm run build",

16 "build:bct": "cd ./municipalities/bct-design-tokens && npm run build",

17 "build:beek": "cd ./municipalities/beek-design-tokens && npm run build",

18 "build:buren": "cd ./municipalities/buren-design-tokens && npm run build",

19 "build:commonground": "cd ./municipalities/commonground-design-tokens && npm run build",

20 "build:dimpact": "cd ./municipalities/dimpact-design-tokens && npm run build",

21 "build:dinkelland": "cd ./municipalities/dinkelland-design-tokens && npm run build",

22 "build:ede": "cd ./municipalities/ede-design-tokens && npm run build",

23 "build:epe": "cd ./municipalities/epe-design-tokens && npm run build",

24 "build:gooise-meren": "cd ./municipalities/gooise-meren-design-tokens && npm run build",

25 "build:gouda": "cd ./municipalities/gouda-design-tokens && npm run build",

26 "build:helmond": "cd ./municipalities/helmond-design-tokens && npm run build",

27 "build:hof-van-twente": "cd ./municipalities/hof-van-twente-design-tokens && npm run build",

28 "build:lansingerland": "cd ./municipalities/lansingerland-design-tokens && npm run build",

29 "build:leiden": "cd ./municipalities/leiden-design-tokens && npm run build",

30 "build:midden-delfland": "cd ./municipalities/midden-delfland-design-tokens && npm run build",

31 "build:migrato": "cd ./municipalities/migrato-design-tokens && npm run build",

municipalities/opencatalogi-design-tokens/src/rotterdam/font/download.shView file

•path = municipalities/opencatalogi-design-[redacted].sh kind = build_helper sizeBytes = 1861 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

municipalities/opencatalogi-design-tokens/src/rotterdam/font/download.shView on unpkg

municipalities/vaals-design-tokens/src/font/GT-Walsheim-Medium.woff2View file

•path = municipalities/vaals-design-tokens/src/font/GT-Walsheim-Medium.woff2 kind = high_entropy_blob sizeBytes = 40564 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

municipalities/vaals-design-tokens/src/font/GT-Walsheim-Medium.woff2View on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = npm run build

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm run build

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

municipalities/opencatalogi-design-tokens/src/rotterdam/font/download.shView file

•path = municipalities/opencatalogi-design-[redacted].sh kind = build_helper sizeBytes = 1861 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

municipalities/opencatalogi-design-tokens/src/rotterdam/font/download.shView on unpkg

municipalities/vaals-design-tokens/src/font/GT-Walsheim-Medium.woff2View file

•path = municipalities/vaals-design-tokens/src/font/GT-Walsheim-Medium.woff2 kind = high_entropy_blob sizeBytes = 40564 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

municipalities/vaals-design-tokens/src/font/GT-Walsheim-Medium.woff2View on unpkg

Findings

2 High3 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobmunicipalities/vaals-design-tokens/src/font/GT-Walsheim-Medium.woff2

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Build Helpermunicipalities/opencatalogi-design-tokens/src/rotterdam/font/download.sh

MediumStructural Risk Force Deep Review

LowScripts Present