registry / @daoyi/timeline / 1.0.9

@daoyi/timeline@1.0.9

TimelineJS modified from Northwestern University Knight Lab.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 71 file(s), 717 KB of source, external domains: api.flickr.com, api.imgur.com, api.twitter.com, assets.documentcloud.org, cdn.knightlab.com, docs.google.com, drive.google.com, embed.spotify.com, fast.wistia.com, graph.facebook.com, imgur.com, instagram.com, npms.io, platform.twitter.com, platform.vine.co, player.vimeo.com, s.imgur.com, sheets-proxy.knightlab.com, sheets.googleapis.com, soundcloud.com, spreadsheets.google.com, timeline.knightlab.com, vine.co, w.soundcloud.com, www.dailymotion.com, www.w3.org, www.youtube.com

Source & flagged code

5 flagged

dist/js/timeline.jsView file

Lines 1-12javascript

1var TL=function(t){var e={};function i(n){if(e[n])return e[n].exports;var r=e[n]={i:n,l:!1,exports:{}};return t[n].call(r.exports,r,r.exports,i),r.l=!0,r.exports}return i.m=t,i.c=e,i.d=function(t,e,n){i.o(t,e)||Object.defineProperty(t,e,{enumerable:!0,get:n})},i.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},i.t=function(t,e){if(1&e&&(t=i(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var n=Object.create(null);if(i.r(n),Object.defineProperty(n,"de ...

2/*! @license DOMPurify 2.3.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.3.6/LICENSE */

3t.exports=function(){"use strict";var t=Object.hasOwnProperty,e=Object.setPrototypeOf,i=Object.isFrozen,n=Object.getPrototypeOf,r=Object.getOwnPropertyDescriptor,a=Object.freeze,o=Object.seal,s=Object.create,l="undefined"!=typeof Reflect&&Reflect,h=l.apply,c=l.construct;h||(h=function(t,e,i){return t.apply(e,i)}),a

4/**

5 * @license

6 * Lodash <https://lodash.com/>

7 * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>

8 * Released under MIT license <https://lodash.com/license>

9 * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>

10 * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors

11 */(function(){var a="Expected a function",o="__lodash_placeholder__",s=[["ary",128],["bind",1],["bindKey",2],["curry",8],["curryRight",16],["flip",512],["partial",32],["partialRight",64],["rearg",256]],l

12//# sourceMappingURL=timeline.js.map

Long lines were clipped for display.

tasks/compile_less.jsView file

Lines 1-21javascript

1const fs = require('fs-extra')

2const less = require('less')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tasks/compile_less.jsView on unpkg · L1

3const path = require('path')

src/js/core/ConfigFactory.jsView file

Lines 194-234javascript

194 }

195

196 if (url_or_key.startsWith('https://docs.google.com/spreadsheets/')) {

197 if (url_or_key.match(/\/pub\?output=csv$/)) return url_or_key

198 let parsed = new

src/js/media/Media.jsView file

Lines 43-83javascript

43 loaded: false,

44 show_meta: false,

45 media_loaded: false

46 };

48 // Data

49 this.data = {

50 unique_id: null,

Source & flagged code

5 flagged · loading source

dist/js/timeline.jsView file

11patternName = google_api_key severity = high line = 11 matchedText = */(funct...}]);

High

High Secret

Package contains a high-severity secret pattern.

dist/js/timeline.jsView on unpkg · L11

11patternName = google_api_key severity = high line = 11 matchedText = */(funct...}]);

High

Secret Pattern

Google API key in dist/js/timeline.js

dist/js/timeline.jsView on unpkg · L11

tasks/compile_less.jsView file

1const fs = require('fs-extra') L2: const less = require('less')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tasks/compile_less.jsView on unpkg · L1

src/js/core/ConfigFactory.jsView file

214patternName = google_api_key severity = high line = 214 matchedText = return "...xg";

High

Secret Pattern

Google API key in src/js/core/ConfigFactory.js

src/js/core/ConfigFactory.jsView on unpkg · L214

src/js/media/Media.jsView file

63patternName = google_api_key severity = high line = 63 matchedText = api_key_...YI",

High

Secret Pattern

Google API key in src/js/media/Media.js

src/js/media/Media.jsView on unpkg · L63

Findings

4 High3 Medium5 Low

HighHigh Secretdist/js/timeline.js

HighSecret Patterndist/js/timeline.js

HighSecret Patternsrc/js/core/ConfigFactory.js

HighSecret Patternsrc/js/media/Media.js

MediumDynamic Requiretasks/compile_less.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

5 flagged

dist/js/timeline.jsView file

Lines 1-12javascript

2/*! @license DOMPurify 2.3.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.3.6/LICENSE */

4/**

5 * @license

6 * Lodash <https://lodash.com/>

7 * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>

8 * Released under MIT license <https://lodash.com/license>

9 * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>

10 * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors

12//# sourceMappingURL=timeline.js.map

Long lines were clipped for display.

tasks/compile_less.jsView file

Lines 1-21javascript

1const fs = require('fs-extra')

2const less = require('less')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tasks/compile_less.jsView on unpkg · L1

3const path = require('path')

src/js/core/ConfigFactory.jsView file

Lines 194-234javascript

194 }

195

196 if (url_or_key.startsWith('https://docs.google.com/spreadsheets/')) {

197 if (url_or_key.match(/\/pub\?output=csv$/)) return url_or_key

198 let parsed = new

src/js/media/Media.jsView file

Lines 43-83javascript

43 loaded: false,

44 show_meta: false,

45 media_loaded: false

46 };

48 // Data

49 this.data = {

50 unique_id: null,