registry  /  @dwelle/excalidraw  /  0.5.0-aee77a4

@dwelle/excalidraw@0.5.0-aee77a4

Excalidraw as a React component

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEvalFilesystemNativeBindingsNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
ManifestNo manifest risk signals triggered.
scanned 139 file(s), 11.4 MB of source, external domains: app.excalidraw.com, discord.gg, docs.excalidraw.com, drive.google.com, embed.reddit.com, esm.sh, excalidraw-room-persistence.firebaseio.com, giphy.com, gist.github.com, github.com, json-dev.excalidraw.com, json.excalidraw.com, libraries.excalidraw.com, mermaid.js.org, oss-ai.excalidraw.com, oss-collab.excalidraw.com, platform.twitter.com, player.vimeo.com, plus.excalidraw.com, reddit.com, twitter.com, us-central1-excalidraw-room-persistence.cloudfunctions.net, www.figma.com, www.w3.org, www.youtube.com, x.com, youtube.com

Source & flagged code

8 flagged · loading source
dist/prod/chunk-Z5NKEFVG.jsView file
1patternName = aws_access_key severity = critical line = 1 matchedText = import{a...A+=`
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/prod/chunk-Z5NKEFVG.jsView on unpkg · L1
1patternName = aws_access_key severity = critical line = 1 matchedText = import{a...A+=`
Critical
Secret Pattern

AWS access key ID in dist/prod/chunk-Z5NKEFVG.js

dist/prod/chunk-Z5NKEFVG.jsView on unpkg · L1
1import{a as Qg}from"./chunk-SRAX5OIU.js";function GQ(F,L,I,y){let Y=F.hb_subset_input_create_or_fail();if(Y===0)throw new Error("hb_subset_input_create_or_fail (harfbuzz) returned ... L2: ${I.extraStackTrace()}`),HI(A)}function dI(A,g,C,Q){w(`Assertion failed: ${T(A)}, at: ${[g?T(g):"unknown filename",C,Q?T(Q):"unknown function"]}`)}function ZI(A){return MA(A)}let t... L3: "use strict"; return body.apply(this, arguments);
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/prod/chunk-Z5NKEFVG.jsView on unpkg · L1
dist/prod/fonts/Assistant/Assistant-Bold.woff2View file
•path = [redacted]-Bold.woff2 kind = high_entropy_blob sizeBytes = 20380 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/prod/fonts/Assistant/Assistant-Bold.woff2View on unpkg
package.jsonView file
•devDependencies tarball_only=cross-env
Critical
Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg
dist/prod/chunk-GQMIMNEC.jsView file
1patternName = google_api_key severity = high line = 1 matchedText = var c={N...AZZX
High
Secret Pattern

Google API key in dist/prod/chunk-GQMIMNEC.js

dist/prod/chunk-GQMIMNEC.jsView on unpkg · L1
dist/dev/chunk-7PSZ5NAU.jsView file
2patternName = google_api_key severity = high line = 2 matchedText = var defi...e };
High
Secret Pattern

Google API key in dist/dev/chunk-7PSZ5NAU.js

dist/dev/chunk-7PSZ5NAU.jsView on unpkg · L2
dist/dev/chunk-6JJSWC4C.jsView file
95patternName = aws_access_key severity = critical line = 95 matchedText = var harf...=`);
Critical
Secret Pattern

AWS access key ID in dist/dev/chunk-6JJSWC4C.js

dist/dev/chunk-6JJSWC4C.jsView on unpkg · L95

Findings

4 Critical3 High3 Medium6 Low
CriticalCritical Secretdist/prod/chunk-Z5NKEFVG.js
CriticalManifest Confusionpackage.json
CriticalSecret Patterndist/prod/chunk-Z5NKEFVG.js
CriticalSecret Patterndist/dev/chunk-6JJSWC4C.js
HighShips High Entropy Blobdist/prod/fonts/Assistant/Assistant-Bold.woff2
HighSecret Patterndist/prod/chunk-GQMIMNEC.js
HighSecret Patterndist/dev/chunk-7PSZ5NAU.js
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/prod/chunk-Z5NKEFVG.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings