registry / @erpsquad/common / 1.10.55

@erpsquad/common@1.10.55

⚠ Under review

Shared UI component library for ERP modules

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 16.9 MB of source, external domains: ak.picdn.net, caniuse.com, developer.mozilla.org, erpforce-dev.s3.eu-west-1.amazonaws.com, example.com, fb.me, github.com, mui.com, mysite.com, picsum.photos, popper.js.org, react-laag.com, reactcommunity.org, reactjs.org, www.w3.org

Source & flagged code

10 flagged

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView file

Lines 10-50javascript

10 logout: "Logout"

11 },

12 dashboard: {

13 name: "Dashboard",

14 title: "Your Apps",

15 subtitle: "Install or add more apps to your library"

16 },

17 quotes: {

18 name: "Quotes",

19 title: "This is the quotes dashboard",

20 quote_page: "This is Quotes page"

21 },

22 user: {

23 name: "Users",

24 title: "This is USER module",

25 user: {

26 title: "Users",

27 add_new_user: "New User",

28 edit_user: "Edit User",

29 view_user: "View User",

30 change_password: "Change Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView on unpkg · L30

31 add_access: "Add Access",

32 resend_invite_email: "Resend Invite Mail",

33 clone_user: "Clone User",

34 deactivate: "Deactivate",

35 activate: "Activate",

36 account: "Account",

37 heading: "No Users Added",

38 subheading: "Start by adding your first user for smoother team collaboration.",

39 msg: {

40 endtime_msg: "End Time must be later than Start Time when Start Date and End Date are the same.",

41 schedule_msg: "Implement scheduled login restrictions to enhance ERP security by controlling user access hours for improved data protection",

42 login_restriction_msg: "Enable daily login restrictions and set time limits for when user access the system.",

43 help_msg: "You can help",

44 reset_password_msg: "reset their password by emailing instructions to",

45 account_access_error_msg: "This account will no longer have access to any module. You can restore access at any time.",

46 account_access_success_msg: "This account will have access to all modules. You can revoke access at any time.",

47 remove_user_msg: "Are you sure you want to remove user",

48 no_resources_msg: "No resources available",

49 delete_success_msg: "User deleted successfully",

50 grant_access_msg: "Grant access to enable this user to retrieve data from multiple branches."

Lines 87-127javascript

87 access_label: "Access",

88 action_label: "Action",

89 add_access_label: "Add Access",

90 add_policy_label: "Add policy",

91 add_access_type_label: "Add Access Type",

92 added_access_label: "Added Access"

93 },

Lines 11089-11129javascript

11089 save_button: "Save"

11090 }

11091 },

11092 msg: {

11093 template_saved: "Template saved successfully",

11094 template_deleted: "Template deleted successfully",

11095 template_error: "Something went wrong while saving template",

11096 unsaved_changes: "You have unsaved changes. Do you want to save before leaving?"

Lines 11233-11273javascript

11233 summary_header: "Resumen",

11234 email_header: "Correo Electrónico"

11235 },

11236 tabs: {

11237 basicDetails: "Detalles Básicos",

11238 address: "Dirección",

11239 contact: "Contacto"

11240 }

dist/chunks/android-12-switch-B3g4zZYt.esm.jsView file

2600contains invisible/control Unicode U+2068 (first strong isolate) value = `<U+2068>${value}<U+2069>`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/android-12-switch-B3g4zZYt.esm.jsView on unpkg · L2600

dist/chunks/android-12-switch-Cx_8Jzve.jsView file

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunks/android-12-switch-Cx_8Jzve.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunks/android-12-switch-Cx_8Jzve.jsView on unpkg

dist/chunks/pathname.quotes-B4wRhPcF.jsView file

Lines 11-51javascript

11 logout: "Logout"

12 },

13 dashboard: {

14 name: "Dashboard",

15 title: "Your Apps",

16 subtitle: "Install or add more apps to your library"

17 },

Source & flagged code

10 flagged · loading source

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView file

30patternName = generic_password severity = medium line = 30 matchedText = change_p...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView on unpkg · L30

107patternName = generic_password severity = medium line = 107 matchedText = reset_pa...rd",

Medium

Secret Pattern

Hardcoded password in dist/chunks/pathname.quotes-pzp49RZA.esm.js

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView on unpkg · L107

11109patternName = generic_password severity = medium line = 11109 matchedText = change_p...eña"

Medium

Secret Pattern

Hardcoded password in dist/chunks/pathname.quotes-pzp49RZA.esm.js

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView on unpkg · L11109

11253patternName = generic_password severity = medium line = 11253 matchedText = change_p...رور"

Medium

Secret Pattern

Hardcoded password in dist/chunks/pathname.quotes-pzp49RZA.esm.js

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView on unpkg · L11253

dist/chunks/android-12-switch-B3g4zZYt.esm.jsView file

2600contains invisible/control Unicode U+2068 (first strong isolate) value = `<U+2068>${value}<U+2069>`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/android-12-switch-B3g4zZYt.esm.jsView on unpkg · L2600

dist/chunks/android-12-switch-Cx_8Jzve.jsView file

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunks/android-12-switch-Cx_8Jzve.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunks/android-12-switch-Cx_8Jzve.jsView on unpkg

dist/chunks/pathname.quotes-B4wRhPcF.jsView file

31patternName = generic_password severity = medium line = 31 matchedText = change_p...rd",

Medium

Secret Pattern

Hardcoded password in dist/chunks/pathname.quotes-B4wRhPcF.js

dist/chunks/pathname.quotes-B4wRhPcF.jsView on unpkg · L31

108patternName = generic_password severity = medium line = 108 matchedText = reset_pa...rd",

Medium

Secret Pattern

Hardcoded password in dist/chunks/pathname.quotes-B4wRhPcF.js

dist/chunks/pathname.quotes-B4wRhPcF.jsView on unpkg · L108

11110patternName = generic_password severity = medium line = 11110 matchedText = change_p...eña"

Medium

Secret Pattern

Hardcoded password in dist/chunks/pathname.quotes-B4wRhPcF.js

dist/chunks/pathname.quotes-B4wRhPcF.jsView on unpkg · L11110

11254patternName = generic_password severity = medium line = 11254 matchedText = change_p...رور"

Medium

Secret Pattern

Hardcoded password in dist/chunks/pathname.quotes-B4wRhPcF.js

dist/chunks/pathname.quotes-B4wRhPcF.jsView on unpkg · L11254

Findings

2 Critical11 Medium4 Low

CriticalTrojan Source Unicodedist/chunks/android-12-switch-B3g4zZYt.esm.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunks/android-12-switch-Cx_8Jzve.js

MediumSecret Patterndist/chunks/pathname.quotes-pzp49RZA.esm.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/chunks/pathname.quotes-pzp49RZA.esm.js

MediumSecret Patterndist/chunks/pathname.quotes-B4wRhPcF.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView file

Lines 10-50javascript

10 logout: "Logout"

11 },

12 dashboard: {

13 name: "Dashboard",

14 title: "Your Apps",

15 subtitle: "Install or add more apps to your library"

16 },

17 quotes: {

18 name: "Quotes",

19 title: "This is the quotes dashboard",

20 quote_page: "This is Quotes page"

21 },

22 user: {

23 name: "Users",

24 title: "This is USER module",

25 user: {

26 title: "Users",

27 add_new_user: "New User",

28 edit_user: "Edit User",

29 view_user: "View User",

30 change_password: "Change Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/pathname.quotes-pzp49RZA.esm.jsView on unpkg · L30

31 add_access: "Add Access",

32 resend_invite_email: "Resend Invite Mail",

33 clone_user: "Clone User",

34 deactivate: "Deactivate",

35 activate: "Activate",

36 account: "Account",

37 heading: "No Users Added",

38 subheading: "Start by adding your first user for smoother team collaboration.",

39 msg: {

40 endtime_msg: "End Time must be later than Start Time when Start Date and End Date are the same.",

41 schedule_msg: "Implement scheduled login restrictions to enhance ERP security by controlling user access hours for improved data protection",

42 login_restriction_msg: "Enable daily login restrictions and set time limits for when user access the system.",

43 help_msg: "You can help",

44 reset_password_msg: "reset their password by emailing instructions to",

45 account_access_error_msg: "This account will no longer have access to any module. You can restore access at any time.",

46 account_access_success_msg: "This account will have access to all modules. You can revoke access at any time.",

47 remove_user_msg: "Are you sure you want to remove user",

48 no_resources_msg: "No resources available",

49 delete_success_msg: "User deleted successfully",

50 grant_access_msg: "Grant access to enable this user to retrieve data from multiple branches."

Lines 87-127javascript

87 access_label: "Access",

88 action_label: "Action",

89 add_access_label: "Add Access",

90 add_policy_label: "Add policy",

91 add_access_type_label: "Add Access Type",

92 added_access_label: "Added Access"

93 },

Lines 11089-11129javascript

11089 save_button: "Save"

11090 }

11091 },

11092 msg: {

11093 template_saved: "Template saved successfully",

11094 template_deleted: "Template deleted successfully",

11095 template_error: "Something went wrong while saving template",

11096 unsaved_changes: "You have unsaved changes. Do you want to save before leaving?"

Lines 11233-11273javascript

11233 summary_header: "Resumen",

11234 email_header: "Correo Electrónico"

11235 },

11236 tabs: {

11237 basicDetails: "Detalles Básicos",

11238 address: "Dirección",

11239 contact: "Contacto"

11240 }

dist/chunks/android-12-switch-B3g4zZYt.esm.jsView file

2600contains invisible/control Unicode U+2068 (first strong isolate) value = `<U+2068>${value}<U+2069>`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/android-12-switch-B3g4zZYt.esm.jsView on unpkg · L2600

dist/chunks/android-12-switch-Cx_8Jzve.jsView file

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunks/android-12-switch-Cx_8Jzve.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunks/android-12-switch-Cx_8Jzve.jsView on unpkg

dist/chunks/pathname.quotes-B4wRhPcF.jsView file

Lines 11-51javascript

11 logout: "Logout"

12 },

13 dashboard: {

14 name: "Dashboard",

15 title: "Your Apps",

16 subtitle: "Install or add more apps to your library"

17 },