registry / @evlop/commons / 1.0.388

@evlop/commons@1.0.388

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The package exposes runtime helpers that can fetch and execute remote or caller-supplied code. This is a dangerous library capability, but inspection did not find automatic install/import-time execution or covert exfiltration.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Consumer calls exported helpers such as loadPackage/loadJSONPModule, EDL render helpers, or evaluateCode with untrusted input.

Impact

Remote code execution in the consumer runtime if untrusted package names, URLs, or EDL/code strings are passed.

Mechanism

remote fetch plus eval/new Function/vm execution

Attack narrative

A consuming app can call loadPackage with a package name/version or external URL, causing the library to fetch JavaScript text and eval it as a JSONP-style module. EDL and evaluateCode paths also compile caller-provided code. These are reachable exported capabilities and could become RCE if fed untrusted input, but there is no lifecycle hook, import-time trigger, secret theft, persistence, or hidden endpoint that makes this package itself malicious.

Rationale

Static inspection confirms high-risk dynamic code execution primitives, especially exported remote fetch plus eval, but they are user-invoked framework/plugin capabilities rather than unconsented automatic attack behavior. Treat as warn-worthy dangerous capability, not publish-block malware.

Evidence

package.jsondist/cjs/main.jsdist/cjs/src/helpers/functions.jsdist/cjs/src/edl/index.jsdist/cjs/src/adapters/evaluateCode/index.jsdist/cjs/bin/generate-google-fonts-cache.jsdist/cjs/bin/generate-google-fonts-cache.js writes ./src/constants/googleFonts/variants.jsondist/cjs/bin/generate-google-fonts-cache.js writes ./src/constants/googleFonts/variants.min.jsondist/cjs/bin/generate-icons-cache.js writes ./src/constants/iconInfo/reactNativeVectorIcons.lookup.jsondist/cjs/bin/generate-icons-cache.js writes ./src/constants/iconInfo/reactNativeVectorIcons.lookup.min.jsondist/cjs/bin/generate-icons-cache.js writes ./src/constants/iconInfo/types.ts

Network endpoints4

cdn.jsdelivr.net/npm/cdn.evlop.com/assets-info/icons.min.json?v=9www.googleapis.com/webfonts/v1/webfonts?key=AIzaSyBwRrjscdahzwbFlwDBqsxWBsX76tEBCvsfonts.googleapis.com/css

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/cjs/src/helpers/functions.js exports loadPackage/loadJSONPModule that fetches URL text and evals it.
loadPackage builds https://cdn.jsdelivr.net/npm/${name}@${version}/dist/index.js or accepts external http(s) base URL.
dist/cjs/src/edl/index.js uses new Function to compile EDL-provided JS when renderBlock/renderModule is called.
dist/cjs/src/adapters/evaluateCode/index.js runs caller-supplied code in vm.runInNewContext.

Evidence against

package.json has no install/postinstall lifecycle hooks or bin entrypoint.
dist/cjs/main.js only re-exports library modules; dangerous functions require runtime caller invocation.
No credential harvesting, persistence, AI-agent control-surface writes, or automatic import-time network execution found.
Network endpoints are package/CDN-aligned or caller-controlled plugin/API URLs.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 324 file(s), 625 KB of source, external domains: api.example.com, cdn.evlop.com, cdn.jsdelivr.net, fonts.googleapis.com, www.googleapis.com

Source & flagged code

8 flagged

dist/esm/bin/generate-google-fonts-cache.jsView file

Lines 9-39javascript

9 "Noto Sans", "Lora", "Assistant", "Roboto Mono", "Cabin",

10 "Dosis", "Heebo", "Mukta", "Arvo", "Quicksand",

11 "Cinzel", "Fira Sans", "Nanum Gothic", "Overpass", "Zilla Slab",

12 "Libre Baskerville", "Rokkitt", "Abel", "Asap", "Cardo",

13 "Manrope", "Red Hat Display", "Martel", "Jost", "IBM Plex Sans",

14 "Alegreya", "Noticia Text", "Sarabun", "Exo 2", "Mulish",

15 "Anton", "Signika", "Inter", "Arimo", "Crimson Text",

16 "Amatic SC", "Varela Round", "Balsamiq Sans", "Cairo", "Karla",

17 "Acme", "Roboto Condensed", "Archivo", "Patua One", "Tinos",

18 "Cormorant Garamond", "DM Serif Display", "Chivo", "Old Standard TT",

19 "Rasa", "Fjalla One", "Prata", "Itim", "Maven Pro",

20 "Mukta Vaani", "Anonymous Pro", "Sarabun", "Recursive", "Fredericka the Great",

21 "Gelasio", "Atkinson Hyperlegible", "Fira Mono", "Courier Prime",

22 "Libre Franklin", "Comfortaa", "Marcellus", "Roboto Flex", "Cormorant",

23 "Gentium Book Basic", "Space Grotesk", "Tenor Sans", "Gothic A1",

24 "Archivo Narrow", "Federo", "Arapey", "Newsreader", "Cantarell",

25 "Public Sans", "Noto Serif", "Alfa Slab One", "Alata",

26 "Teko", "Spectral SC", "Rubik", "Belleza", "Coustard", "Instrument Sans",

27 "Instrument Serif", "Albert Sans",

28];

29const fonts = axios.get('https://www.googleapis.com/webfonts/v1/webfonts?key=AIzaSyBwRrjscdahzwbFlwDBqsxWBsX76tEBCvs')

High

High Secret

Package contains a high-severity secret pattern.

dist/esm/bin/generate-google-fonts-cache.jsView on unpkg · L29

High

Secret Pattern

Google API key in dist/esm/bin/generate-google-fonts-cache.js

dist/esm/bin/generate-google-fonts-cache.jsView on unpkg · L29

30 .then(res => keyBy(res.data.items, 'family'))

31 // only pick popular fonts

32 .then(fonts => popularFontFamilies.map(fontFamily => fonts[fontFamily]).filter(Boolean))

33 .then(fonts => fonts.map(font => [font.family, font.variants.join(',')]))

34 // save to file

35 .then(fonts => {

36 writeFileSync('./src/constants/googleFonts/variants.json', JSON.stringify(fonts, null, 2));

37 writeFileSync('./src/constants/googleFonts/variants.min.json', JSON.stringify(fonts));

38});

39//# sourceMappingURL=generate-google-fonts-cache.js.map

dist/esm/src/adapters/evaluateCode/index.native.jsView file

Lines 1-10javascript

1export default function evaluateCode(code, context) {

2 if (typeof context !== 'object')

3 throw new Error('Context must be a object');

4 const

dist/esm/src/adapters/evaluateCode/index.jsView file

Lines 1-5javascript

1import vm from 'vm';

2export default function evaluateCode(code, context) {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/esm/src/adapters/evaluateCode/index.jsView on unpkg · L1

3 return vm.runInNewContext(`exports = ${code}`, context);

dist/esm/src/helpers/functions.jsView file

Lines 1-41javascript

1export function createNestedTree(items = [], parent = null) {

2 const result = items.filter(item => ((!parent && !item.parent) || item.parent === parent));

dist/cjs/src/helpers/functions.jsView file

•Trigger-reachable chain: manifest.main -> dist/cjs/main.js -> dist/cjs/src/helpers/index.js -> dist/cjs/src/helpers/functions.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cjs/src/helpers/functions.jsView on unpkg

dist/cjs/src/edl/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @evlop/commons@1.0.383 matchedIdentity = npm:QGV2bG9wL2NvbW1vbnM:1.0.383 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cjs/src/edl/index.jsView on unpkg

dist/cjs/bin/generate-google-fonts-cache.jsView file

Lines 14-44javascript

14 "Noto Sans", "Lora", "Assistant", "Roboto Mono", "Cabin",

15 "Dosis", "Heebo", "Mukta", "Arvo", "Quicksand",

16 "Cinzel", "Fira Sans", "Nanum Gothic", "Overpass", "Zilla Slab",

Source & flagged code

8 flagged · loading source

dist/esm/bin/generate-google-fonts-cache.jsView file

29patternName = google_api_key severity = high line = 29 matchedText = const fo...vs')

High

High Secret

Package contains a high-severity secret pattern.

dist/esm/bin/generate-google-fonts-cache.jsView on unpkg · L29

29patternName = google_api_key severity = high line = 29 matchedText = const fo...vs')

High

Secret Pattern

Google API key in dist/esm/bin/generate-google-fonts-cache.js

dist/esm/bin/generate-google-fonts-cache.jsView on unpkg · L29

dist/esm/src/adapters/evaluateCode/index.native.jsView file

3throw new Error('Context must be a object'); L4: const fn = eval(`(context)=>{ L5: ${Object.keys(context).map(key => `const ${key} = context['${key}'];`).join('\n')}

High

Eval

Package source references dynamic code evaluation.

dist/esm/src/adapters/evaluateCode/index.native.jsView on unpkg · L3

dist/esm/src/adapters/evaluateCode/index.jsView file

1import vm from 'vm'; L2: export default function evaluateCode(code, context) {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/esm/src/adapters/evaluateCode/index.jsView on unpkg · L1

dist/esm/src/helpers/functions.jsView file

21export function loadPackage(name, version) { L22: const url = isExternalUrl(name) ? `${name}/index.js` : `https://cdn.jsdelivr.net/npm/${name}@${version}/dist/index.js`; L23: return loadJSONPModule({ name: 'registerModule', url }); ... L26: return fetch(url) L27: .then(r => r.text()) L28: .then(moduleData => eval(`const ${name} = a => a;${moduleData};`)); L29: };

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/esm/src/helpers/functions.jsView on unpkg · L21

dist/cjs/src/helpers/functions.jsView file

•Trigger-reachable chain: manifest.main -> dist/cjs/main.js -> dist/cjs/src/helpers/index.js -> dist/cjs/src/helpers/functions.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cjs/src/helpers/functions.jsView on unpkg

dist/cjs/src/edl/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cjs/src/edl/index.jsView on unpkg

dist/cjs/bin/generate-google-fonts-cache.jsView file

34patternName = google_api_key severity = high line = 34 matchedText = const fo...vs')

High

Secret Pattern

Google API key in dist/cjs/bin/generate-google-fonts-cache.js

dist/cjs/bin/generate-google-fonts-cache.jsView on unpkg · L34

Findings

3 Critical5 High4 Medium4 Low

CriticalRemote Asset Decode Executedist/esm/src/helpers/functions.js

CriticalTrigger Reachable Dangerous Capabilitydist/cjs/src/helpers/functions.js

CriticalPrevious Version Dangerous Deltadist/cjs/src/edl/index.js

HighHigh Secretdist/esm/bin/generate-google-fonts-cache.js

HighChild Process

HighEvaldist/esm/src/adapters/evaluateCode/index.native.js

HighSecret Patterndist/esm/bin/generate-google-fonts-cache.js

HighSecret Patterndist/cjs/bin/generate-google-fonts-cache.js

MediumUnsafe Vm Contextdist/esm/src/adapters/evaluateCode/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/esm/bin/generate-google-fonts-cache.jsView file

Lines 9-39javascript

9 "Noto Sans", "Lora", "Assistant", "Roboto Mono", "Cabin",

10 "Dosis", "Heebo", "Mukta", "Arvo", "Quicksand",

11 "Cinzel", "Fira Sans", "Nanum Gothic", "Overpass", "Zilla Slab",

12 "Libre Baskerville", "Rokkitt", "Abel", "Asap", "Cardo",

13 "Manrope", "Red Hat Display", "Martel", "Jost", "IBM Plex Sans",

14 "Alegreya", "Noticia Text", "Sarabun", "Exo 2", "Mulish",

15 "Anton", "Signika", "Inter", "Arimo", "Crimson Text",

16 "Amatic SC", "Varela Round", "Balsamiq Sans", "Cairo", "Karla",

17 "Acme", "Roboto Condensed", "Archivo", "Patua One", "Tinos",

18 "Cormorant Garamond", "DM Serif Display", "Chivo", "Old Standard TT",

19 "Rasa", "Fjalla One", "Prata", "Itim", "Maven Pro",

20 "Mukta Vaani", "Anonymous Pro", "Sarabun", "Recursive", "Fredericka the Great",

21 "Gelasio", "Atkinson Hyperlegible", "Fira Mono", "Courier Prime",

22 "Libre Franklin", "Comfortaa", "Marcellus", "Roboto Flex", "Cormorant",

23 "Gentium Book Basic", "Space Grotesk", "Tenor Sans", "Gothic A1",

24 "Archivo Narrow", "Federo", "Arapey", "Newsreader", "Cantarell",

25 "Public Sans", "Noto Serif", "Alfa Slab One", "Alata",

26 "Teko", "Spectral SC", "Rubik", "Belleza", "Coustard", "Instrument Sans",

27 "Instrument Serif", "Albert Sans",

28];

29const fonts = axios.get('https://www.googleapis.com/webfonts/v1/webfonts?key=AIzaSyBwRrjscdahzwbFlwDBqsxWBsX76tEBCvs')

High

High Secret

Package contains a high-severity secret pattern.

dist/esm/bin/generate-google-fonts-cache.jsView on unpkg · L29

High

Secret Pattern

Google API key in dist/esm/bin/generate-google-fonts-cache.js

dist/esm/bin/generate-google-fonts-cache.jsView on unpkg · L29

30 .then(res => keyBy(res.data.items, 'family'))

31 // only pick popular fonts

32 .then(fonts => popularFontFamilies.map(fontFamily => fonts[fontFamily]).filter(Boolean))

33 .then(fonts => fonts.map(font => [font.family, font.variants.join(',')]))

34 // save to file

35 .then(fonts => {

36 writeFileSync('./src/constants/googleFonts/variants.json', JSON.stringify(fonts, null, 2));

37 writeFileSync('./src/constants/googleFonts/variants.min.json', JSON.stringify(fonts));

38});

39//# sourceMappingURL=generate-google-fonts-cache.js.map

dist/esm/src/adapters/evaluateCode/index.native.jsView file

Lines 1-10javascript

1export default function evaluateCode(code, context) {

2 if (typeof context !== 'object')

3 throw new Error('Context must be a object');

4 const

dist/esm/src/adapters/evaluateCode/index.jsView file

Lines 1-5javascript

1import vm from 'vm';

2export default function evaluateCode(code, context) {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/esm/src/adapters/evaluateCode/index.jsView on unpkg · L1

3 return vm.runInNewContext(`exports = ${code}`, context);

dist/esm/src/helpers/functions.jsView file

Lines 1-41javascript

1export function createNestedTree(items = [], parent = null) {

2 const result = items.filter(item => ((!parent && !item.parent) || item.parent === parent));

dist/cjs/src/helpers/functions.jsView file

•Trigger-reachable chain: manifest.main -> dist/cjs/main.js -> dist/cjs/src/helpers/index.js -> dist/cjs/src/helpers/functions.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cjs/src/helpers/functions.jsView on unpkg

dist/cjs/src/edl/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cjs/src/edl/index.jsView on unpkg

dist/cjs/bin/generate-google-fonts-cache.jsView file

Lines 14-44javascript

14 "Noto Sans", "Lora", "Assistant", "Roboto Mono", "Cabin",

15 "Dosis", "Heebo", "Mukta", "Arvo", "Quicksand",

16 "Cinzel", "Fira Sans", "Nanum Gothic", "Overpass", "Zilla Slab",