Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@domphy/doctor@0.18.14: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 10 finding(s) warrant review before installing.

View on npm All versions

registry / @domphy/doctor / 0.18.14

@domphy/doctor@0.18.14

Domphy Doctor - static analyzer that flags non-idiomatic Domphy element trees (AI self-correction)

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 318 KB of source, external domains: github.com, htmlhint.com, stylelint.io

Oversized source lightweight scan

dist/doctor.global.js4.67 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoObfuscated

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

HighEntropyStrings

Minified

UrlStrings

github.com

htmlhint.com

stylelint.io

Source & flagged code

3 flagged · loading source

dist/index.cjsView file

1"use strict";var X=Object.create;var T=Object.defineProperty;var Z=Object.getOwnPropertyDescriptor;var ee=Object.getOwnPropertyNames;var te=Object.getPrototypeOf,ne=Object.prototyp... L2: ${n.message}${n.hint?`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

dist/index.jsView file

3package = @domphy/doctor; repositoryIdentity = domphy; dependency = htmlhint L3: \u2192 ${t.hint}`:""}`).join(` L4: `)}function N(e){if(Array.isArray(e))return e.map(N);if(y(e)){let n={};for(let t in e)n[t]=N(e[t]);return n}return e}function he(e,n={}){let t=N(e),s=[];return O(t,"",s),{tree:t,ap... L5: //# sourceMappingURL=index.js.map

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L3

dist/doctor.global.jsView file

•path = dist/doctor.global.js kind = oversized_source_file sizeBytes = 4901166 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/doctor.global.jsView on unpkg

Findings

2 High3 Medium5 Low

HighCopied Package Dependency Bridgedist/index.js

HighOversized Source Filedist/doctor.global.js

MediumDynamic Requiredist/index.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

AuthorHuu Khanh Nguyen

Maintainershuukhanhnguyen

Version0.18.15

PublishedJul 18, 2026

LicenseMIT

Dependencies5

Integrityverified

Package size5.54 MB

Files12

Keywordsdomphydoctorlintvalidateai

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → domphy-doctor

RuntimeNo engine / OS / CPU constraints

Artifact23.5 MB · 12 files1 signature(s)

Install lifecycleNo install hooks · other: build, dev, pack, test +1

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemHighEntropyStringsMinifiedObfuscatedUrlStringsManifest: clean

LPM CLI

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 1-5javascript

1"use strict";var X=Object.create;var T=Object.defineProperty;var Z=Object.getOwnPropertyDescriptor;var ee=Object.getOwnPropertyNames;var te=Object.getPrototypeOf,ne=Object.prototype.hasOwnProperty;var re=(e,t)=>{for(var n in t)T(e,n,{get:t[n],enumerable:!0})},z=(e,t,n,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of ee(t))!ne.call(e,a)&&a!==n&&T(e,a,{get:()=>t[a],enumerable:!(i=Z(t,a))||i.enumerable});return e};var B=(e,t,n)=>(n=e!=null?X(te(e)):{},z(t||!e||!e.__esModule?T(n,"default",{value:e,enumerable:!0}):n,e)),ie=e=>z(T({},"__esModule",{value:!0}),e);var D=(e,t,n)=>new Pro ...

2 ${n.message}${n.hint?`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

3 \u2192 ${n.hint}`:""}`).join(`

4`)}function E(e){if(Array.isArray(e))return e.map(E);if(y(e)){let t={};for(let n in e)t[n]=E(e[n]);return t}return e}function J(e,t={}){let n=E(e),i=[];return M(n,"",i),{tree:n,applied:i,report:N(n,t)}}function M(e,t,n){if(Array.isArray(e)){for(let[s,l]of e.entries())M(l,`${t}[${s}]`,n);return}if(!y(e))return;let i=R(e);if(!i)return;let a=t?`${t} > ${i}`:i;L.has(i)&&e[i]!==null&&e[i]!==void 0&&(e[i]=null,n.push({rule:"void-content",path:a,message:`Void tag <${i}> cannot have content \u2014 cleared to null.`})),M(e[i],a,n)}var ke={"alt-require":!0,"attr-no-duplication":!0,"button-type-require": ...

5//# sourceMappingURL=index.cjs.map

Long lines were clipped for display.

dist/index.jsView file

Lines 1-5javascript

1var C=(e,n,t)=>new Promise((s,c)=>{var i=l=>{try{

dist/doctor.global.jsView file

•path = dist/doctor.global.js kind = oversized_source_file sizeBytes = 4901166 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/doctor.global.jsView on unpkg

f

(t.

next

(l))}

catch

(d){

c

(d)}},

a

=

l

=>

{

try

{

f

(t.

throw

(l))}

catch

(d){

c

(d)}},

f

=

l

=>

l.done

?

s

(l.value)

:

Promise

.

resolve

(l.value).

then

(i,a);

f

((t

=

t.

apply

(e,n)).

next

())});

import

{cssRgbToRgb

as

q,hexToRgb

as

K,labToLch

as

J,rgbToLab

as

Q}

from

"@domphy/palette"

;

import

{HtmlTags

as

B,SvgTags

as

G,VoidTags

as

U}

from

"@domphy/core"

;

var

Y

=new

Set

([

...

B

,

...

G

]),

R

=new

Set

(

U

);

function

y

(

e

){

return

typeof

e

==

"object"

&&

e

!==

null

&&!

Array.

isArray

(e)}

function

S

(

e

){

for

(

let

n

in

e)

if

(

Y

.

has

(n))

return

n}

var

X

=new

Set

([

"$"

,

"style"

,

"_key"

,

"_portal"

,

"_context"

,

"_metadata"

,

"_doctorDisabl ..

.

2 ${t.message}${t.hint?`

3 \u2192 ${t.hint}`:""}`).join(`

4`)}function N(e){if(Array.isArray(e))return e.map(N);if(y(e)){let n={};for(let t in e)n[t]=N(e[t]);return n}return e}function he(e,n={}){let t=N(e),s=[];return O(t,"",s),{tree:t,applied:s,report:A(t,n)}}function O(e,n,t){if(Array.isArray(e)){for(let[i,a]of e.entries())O(a,`${n}[${i}]`,t);return}if(!y(e))return;let s=S(e);if(!s)return;let c=n?`${n} > ${s}`:s;R.has(s)&&e[s]!==null&&e[s]!==void 0&&(e[s]=null,t.push({rule:"void-content",path:c,message:`Void tag <${s}> cannot have content \u2014 cleared to null.`})),O(e[s],c,t)}var de={"alt-require":!0,"attr-no-duplication":!0,"button-type-require" ...

5//# sourceMappingURL=index.js.map

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L3

Long lines were clipped for display.