registry / @feedmepos/mf-inventory-portal / 1.7.0-dev.7

@feedmepos/mf-inventory-portal@1.7.0-dev.7

⚠ Under review

## Description

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 105 file(s), 9.24 MB of source, external domains: api.github.com, blog.hackers-cafe.net, cdnjs.cloudflare.com, docs.oracle.com, edge.api.flagsmith.com, feature-flag-proxy.feedme.farm, feedme.ai, github.com, jspdf.default.namespaceuri, lodash.com, maps.googleapis.com, npm.pkg.github.com, npms.io, openjsf.org, openoffice.org, opensource.org, purl.oclc.org, purl.org, realtime.flagsmith.com, registry.npmjs.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, sheetjs.openxmlformats.org, sms.feedmeapi.com, stuk.github.io, tc39.es, underscorejs.org, webpjs.appspot.com, www.cs.cmu.edu, www.fpdf.org, www.myersdaily.org, www.pakpost.gov.pk, www.phpied.com, www.w3.org, www.yworks.com

Oversized source lightweight scan

dist/app-C5ZjmQBL.js4.72 MB file, sampled 256 KB

HighEntropyStrings

Source & flagged code

3 flagged

dist/jszip.min-IIc159ih.jsView file

Lines 2245-2285javascript

2245 } : function() {

2246 if (o.postMessage && !o.importScripts) {

2247 var x = !0, E = o.onmessage;

2248 return o.onmessage = function() {

2249 x = !1;

2250 }, o.postMessage("", "*"), o.onmessage = E, x;

2251 }

2252 }() ? (p = "setImmediate$" + Math.random() + "$", o.addEventListener ? o.addEventListener("message", b, !1) : o.attachEvent("onmessage", b), function(x) {

2253 o.postMessage(p + x, "*");

2254 }) : o.MessageChannel ? ((y = new MessageChannel()).port1.onmessage = function(x) {

2255 f(x.data);

2256 }, function(x) {

2257 y.port2.postMessage(x);

2258 }) : r && "onreadystatechange" in r.createElement("script") ? (m = r.documentElement, function(x) {

2259 var E = r.createElement("script");

2260 E.onreadystatechange = function() {

2261 f(x), E.onreadystatechange = null, m.removeChild(E), E = null;

2262 }, m.appendChild(E);

2263 }) : function(x) {

2264 setTimeout(f, 0, x);

2265 }, d.setImmediate = function(x) {

2266 typeof x != "function" && (x = new Function("" + x));

2267 for (var E = new Array(arguments.length - 1), B = 0; B < E.length; B++) E[B] = arguments[B +

2268 var C = { callback: x, args: E };

2269 return i[g] = C, u(g), g++;

2270 }, d.clearImmediate = s;

2271 }

2272 function s(x) {

2273 delete i[x];

2274 }

2275 function f(x) {

2276 if (h) setTimeout(f, 0, x);

2277 else {

2278 var E = i[x];

2279 if (E) {

2280 h = !0;

2281 try {

2282 (function(B) {

2283 var C = B.callback, L = B.args;

2284 switch (L.length) {

2285 case 0:

dist/IntegrationExplorerView-WgrLMM-S.jsView file

9157contains invisible/control Unicode U+200B (zero width space) --؜<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF￹-]`, oo), Dp = {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/IntegrationExplorerView-WgrLMM-S.jsView on unpkg · L9157

dist/app-C5ZjmQBL.jsView file

•path = dist/app-C5ZjmQBL.js kind = oversized_source_file sizeBytes = 4946083 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/app-C5ZjmQBL.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/jszip.min-IIc159ih.jsView file

2265}, d.setImmediate = function(x) { L2266: typeof x != "function" && (x = new Function("" + x)); L2267: for (var E = new Array(arguments.length - 1), B = 0; B < E.length; B++) E[B] = arguments[B + 1];

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/jszip.min-IIc159ih.jsView on unpkg · L2265

dist/IntegrationExplorerView-WgrLMM-S.jsView file

9157contains invisible/control Unicode U+200B (zero width space) --؜<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF￹-]`, oo), Dp = {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/IntegrationExplorerView-WgrLMM-S.jsView on unpkg · L9157

dist/app-C5ZjmQBL.jsView file

•path = dist/app-C5ZjmQBL.js kind = oversized_source_file sizeBytes = 4946083 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/app-C5ZjmQBL.jsView on unpkg

Findings

1 Critical1 High2 Medium7 Low

CriticalTrojan Source Unicodedist/IntegrationExplorerView-WgrLMM-S.js

HighOversized Source Filedist/app-C5ZjmQBL.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/jszip.min-IIc159ih.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/jszip.min-IIc159ih.jsView file

Lines 2245-2285javascript

2245 } : function() {

2246 if (o.postMessage && !o.importScripts) {

2247 var x = !0, E = o.onmessage;

2248 return o.onmessage = function() {

2249 x = !1;

2250 }, o.postMessage("", "*"), o.onmessage = E, x;

2251 }

2252 }() ? (p = "setImmediate$" + Math.random() + "$", o.addEventListener ? o.addEventListener("message", b, !1) : o.attachEvent("onmessage", b), function(x) {

2253 o.postMessage(p + x, "*");

2254 }) : o.MessageChannel ? ((y = new MessageChannel()).port1.onmessage = function(x) {

2255 f(x.data);

2256 }, function(x) {

2257 y.port2.postMessage(x);

2258 }) : r && "onreadystatechange" in r.createElement("script") ? (m = r.documentElement, function(x) {

2259 var E = r.createElement("script");

2260 E.onreadystatechange = function() {

2261 f(x), E.onreadystatechange = null, m.removeChild(E), E = null;

2262 }, m.appendChild(E);

2263 }) : function(x) {

2264 setTimeout(f, 0, x);

2265 }, d.setImmediate = function(x) {

2266 typeof x != "function" && (x = new Function("" + x));

2267 for (var E = new Array(arguments.length - 1), B = 0; B < E.length; B++) E[B] = arguments[B +

2268 var C = { callback: x, args: E };

2269 return i[g] = C, u(g), g++;

2270 }, d.clearImmediate = s;

2271 }

2272 function s(x) {

2273 delete i[x];

2274 }

2275 function f(x) {

2276 if (h) setTimeout(f, 0, x);

2277 else {

2278 var E = i[x];

2279 if (E) {

2280 h = !0;

2281 try {

2282 (function(B) {

2283 var C = B.callback, L = B.args;

2284 switch (L.length) {

2285 case 0:

dist/IntegrationExplorerView-WgrLMM-S.jsView file

9157contains invisible/control Unicode U+200B (zero width space) --؜<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF￹-]`, oo), Dp = {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/IntegrationExplorerView-WgrLMM-S.jsView on unpkg · L9157

dist/app-C5ZjmQBL.jsView file

•path = dist/app-C5ZjmQBL.js kind = oversized_source_file sizeBytes = 4946083 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/app-C5ZjmQBL.jsView on unpkg