registry / @dativa-lv/lx-ui / 2.2.8

@dativa-lv/lx-ui@2.2.8

LX/UI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,725 file(s), 13.1 MB of source, external domains: atomiks.github.io, fallback.namespace, fastly.jsdelivr.net, github.com, leafletjs.com, npms.io, ns.adobe.com, prosemirror.net, purl.org, rolldown.rs, stuk.github.io, www.openstreetmap.org, www.w3.org

Oversized source lightweight scan

dist/dativa-lv-lx-ui.umd.js18.8 MB file, sampled 256 KB

HighEntropyStringsMinifiedUrlStringswww.w3.org

dist/pdf.worker-Bf8xbH2E.js2.81 MB file, sampled 256 KB

Minified

dist/toolkit_bg-HHS8E2cg.js4.56 MB file, sampled 256 KB

Minified

Source & flagged code

4 flagged

dist/jsrsasign-D5-_ccsh.jsView file

Lines 6823-6863javascript

6823 }

6824 }, this.updateString = function(e) {

6825 throw "updateString(str) not supported for this alg/prov: " + this.algProv;

6826 }, this.updateHex = function(e) {

6827 throw "updateHex(hex) not supported for this alg/prov: " + this.algProv;

6828 }, this.doFinal = function() {

6829 throw "digest() not supported for this alg/prov: " + this.algProv;

6830 }, this.doFinalString = function(e) {

6831 throw "digestString(str) not supported for this alg/prov: " + this.algProv;

6832 }, this.doFinalHex = function(e) {

6833 throw "digestHex(hex) not supported for this alg/prov: " + this.algProv;

6834 }, this.setPassword = function(e) {

6835 if (typeof e == "string") {

6836 var t = e;

6837 (e.length % 2 == 1 || !e.match(/^[0-9A-Fa-f]+$/)) && (t = Kn(e)), this.pass = a.enc.Hex.parse(t);

6838 return;

6839 }

6840 if (typeof e != "object") throw "KJUR.crypto.Mac unsupported password type: " + e;

6841 var t = null;

6842 if (e.hex !== void 0) {

6843 if (e.hex.length % 2 != 0 || !e.hex.match(/^[0-9A-Fa-f]+$/)) throw "Mac: wrong hex password: " + e.hex;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/jsrsasign-D5-_ccsh.jsView on unpkg · L6843

6844 t = e.hex;

6845 }

6846 if (e.utf8 !== void 0 && (t = Un(e.utf8)), e.rstr !== void 0 && (t = Kn(e.rstr)), e.b64 !== void 0 && (t = l(e.b64)), e.b64u !== void 0 && (t = G

6847 this.pass = a.enc.Hex.parse(t);

6848 }, e !== void 0 && (e.pass !== void 0 && this.setPassword(e.pass), e.alg !== void 0 && (this.algName = e.alg, e.prov === void 0 && (this.provName = H.crypto.Util.DEFAULTPROVIDER[

6849 }, H.crypto.Signature = function(e) {

6850 var t = null;

6851 if (this._setAlgNames = function() {

6852 var e = this.algName.match(/^(.+)with(.+)$/);

6853 e && (this.mdAlgName = e[1].toLowerCase(), this.pubkeyAlgName = e[2].toLowerCase(), this.pubkeyAlgName == "rsaandmgf1" && this.mdAlgName == "sha" && (this.mdAlgName = "sha1"));

6854 }, this._zeroPaddingOfSignature = function(e, t) {

6855 for (var n = "", r = t / 4 - e.length, i = 0; i < r; i++) n += "0";

6856 return n + e;

6857 }, this.setAlgAndProvider = function(e, t) {

6858 if (this._setAlgNames(), t != "cryptojs/jsrsa") throw Error("provider not supported: " + t);

6859 if (":md5:sha1:sha224:sha256:sha384:sha512:ripemd160:".indexOf(this.mdAlgName) != -1) {

6860 try {

6861 this.md = new H.crypto.MessageDigest({ alg: this.mdAlgName });

6862 } catch (e) {

6863 throw Error("setAlgAndProvider hash alg set fail alg=" + this.mdAlgName + "/" + e);

dist/pdf-DE59lw_E.jsView file

Lines 3923-3963javascript

3923 let t = `${this.baseUrl}${e}`;

3924 return this._fetch(t).catch((e) => {

3925 throw Error(`Unable to load font data at: ${t}`);

dist/lx-fonts/DepartureMono-Regular.woff2View file

•path = dist/lx-fonts/DepartureMono-Regular.woff2 kind = high_entropy_blob sizeBytes = 22496 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/lx-fonts/DepartureMono-Regular.woff2View on unpkg

dist/dativa-lv-lx-ui.umd.jsView file

•path = dist/dativa-lv-lx-ui.umd.js kind = oversized_source_file sizeBytes = 19660934 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dativa-lv-lx-ui.umd.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/jsrsasign-D5-_ccsh.jsView file

6843patternName = generic_password severity = medium line = 6843 matchedText = if (e.he...hex;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/jsrsasign-D5-_ccsh.jsView on unpkg · L6843

dist/pdf-DE59lw_E.jsView file

3943_createCanvas(e, t) { L3944: return process.getBuiltinModule("module").createRequire(import.meta.url)("@napi-rs/canvas").createCanvas(e, t); L3945: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pdf-DE59lw_E.jsView on unpkg · L3943

dist/lx-fonts/DepartureMono-Regular.woff2View file

•path = dist/lx-fonts/DepartureMono-Regular.woff2 kind = high_entropy_blob sizeBytes = 22496 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/lx-fonts/DepartureMono-Regular.woff2View on unpkg

dist/dativa-lv-lx-ui.umd.jsView file

•path = dist/dativa-lv-lx-ui.umd.js kind = oversized_source_file sizeBytes = 19660934 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dativa-lv-lx-ui.umd.jsView on unpkg

Findings

2 High5 Medium5 Low

HighShips High Entropy Blobdist/lx-fonts/DepartureMono-Regular.woff2

HighOversized Source Filedist/dativa-lv-lx-ui.umd.js

MediumSecret Patterndist/jsrsasign-D5-_ccsh.js

MediumDynamic Requiredist/pdf-DE59lw_E.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/jsrsasign-D5-_ccsh.jsView file

Lines 6823-6863javascript

6823 }

6824 }, this.updateString = function(e) {

6825 throw "updateString(str) not supported for this alg/prov: " + this.algProv;

6826 }, this.updateHex = function(e) {

6827 throw "updateHex(hex) not supported for this alg/prov: " + this.algProv;

6828 }, this.doFinal = function() {

6829 throw "digest() not supported for this alg/prov: " + this.algProv;

6830 }, this.doFinalString = function(e) {

6831 throw "digestString(str) not supported for this alg/prov: " + this.algProv;

6832 }, this.doFinalHex = function(e) {

6833 throw "digestHex(hex) not supported for this alg/prov: " + this.algProv;

6834 }, this.setPassword = function(e) {

6835 if (typeof e == "string") {

6836 var t = e;

6837 (e.length % 2 == 1 || !e.match(/^[0-9A-Fa-f]+$/)) && (t = Kn(e)), this.pass = a.enc.Hex.parse(t);

6838 return;

6839 }

6840 if (typeof e != "object") throw "KJUR.crypto.Mac unsupported password type: " + e;

6841 var t = null;

6842 if (e.hex !== void 0) {

6843 if (e.hex.length % 2 != 0 || !e.hex.match(/^[0-9A-Fa-f]+$/)) throw "Mac: wrong hex password: " + e.hex;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/jsrsasign-D5-_ccsh.jsView on unpkg · L6843

6844 t = e.hex;

6845 }

6846 if (e.utf8 !== void 0 && (t = Un(e.utf8)), e.rstr !== void 0 && (t = Kn(e.rstr)), e.b64 !== void 0 && (t = l(e.b64)), e.b64u !== void 0 && (t = G

6847 this.pass = a.enc.Hex.parse(t);

6848 }, e !== void 0 && (e.pass !== void 0 && this.setPassword(e.pass), e.alg !== void 0 && (this.algName = e.alg, e.prov === void 0 && (this.provName = H.crypto.Util.DEFAULTPROVIDER[

6849 }, H.crypto.Signature = function(e) {

6850 var t = null;

6851 if (this._setAlgNames = function() {

6852 var e = this.algName.match(/^(.+)with(.+)$/);

6853 e && (this.mdAlgName = e[1].toLowerCase(), this.pubkeyAlgName = e[2].toLowerCase(), this.pubkeyAlgName == "rsaandmgf1" && this.mdAlgName == "sha" && (this.mdAlgName = "sha1"));

6854 }, this._zeroPaddingOfSignature = function(e, t) {

6855 for (var n = "", r = t / 4 - e.length, i = 0; i < r; i++) n += "0";

6856 return n + e;

6857 }, this.setAlgAndProvider = function(e, t) {

6858 if (this._setAlgNames(), t != "cryptojs/jsrsa") throw Error("provider not supported: " + t);

6859 if (":md5:sha1:sha224:sha256:sha384:sha512:ripemd160:".indexOf(this.mdAlgName) != -1) {

6860 try {

6861 this.md = new H.crypto.MessageDigest({ alg: this.mdAlgName });

6862 } catch (e) {

6863 throw Error("setAlgAndProvider hash alg set fail alg=" + this.mdAlgName + "/" + e);

dist/pdf-DE59lw_E.jsView file

Lines 3923-3963javascript

3923 let t = `${this.baseUrl}${e}`;

3924 return this._fetch(t).catch((e) => {

3925 throw Error(`Unable to load font data at: ${t}`);

dist/lx-fonts/DepartureMono-Regular.woff2View file

•path = dist/lx-fonts/DepartureMono-Regular.woff2 kind = high_entropy_blob sizeBytes = 22496 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/lx-fonts/DepartureMono-Regular.woff2View on unpkg

dist/dativa-lv-lx-ui.umd.jsView file

•path = dist/dativa-lv-lx-ui.umd.js kind = oversized_source_file sizeBytes = 19660934 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dativa-lv-lx-ui.umd.jsView on unpkg