registry  /  @file-viewer/web  /  2.1.14

@file-viewer/web@2.1.14

Standard pure web component package for Flyfish File Viewer

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 241 file(s), 10.9 MB of source, external domains: api.github.com, app.diagrams.net, cdn.jsdelivr.net, convert.diagrams.net, github.com, gitlab.com, log.diagrams.net, log.draw.io, plant-aws.diagrams.net, purl.oclc.org, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.openxmlformats.org, stuk.github.io, viewer.diagrams.net, www.draw.io, www.w3.org
Oversized source lightweight scan
viewer/vendor/drawio/viewer-static.min.js3.73 MB file, sampled 256 KB
HighEntropyStringsMinifiedTelemetryUrlStringsapi.github.comapp.diagrams.netconvert.diagrams.netgithub.comgitlab.comlog.diagrams.netlog.draw.ioplant-aws.diagrams.netviewer.diagrams.netwww.w3.org
viewer/vendor/pdf/pdf.worker.mjs2.25 MB file, sampled 256 KB
NetworkChildProcessHighEntropyStringsUrlStringsgithub.com

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./scripts/copy-assets.mjs --postinstall
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./scripts/copy-assets.mjs --postinstall
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/assets/pptx.worker-BPX7kcb_.jsView file
3045}, L.setImmediate = function(M) { L3046: typeof M != "function" && (M = new Function("" + M)); L3047: for (var J = new Array(arguments.length - 1), se = 0; se < J.length; se++) J[se] = arguments[se + 1];
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pptx.worker-BPX7kcb_.jsView on unpkg · L3045
viewer/wasm/cad/libredwg-web.jsView file
7L8: var Module=moduleArg;var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject});var ENVIRONM... L9:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

viewer/wasm/cad/libredwg-web.jsView on unpkg · L7
viewer/wasm/typst/typst_ts_renderer_bg.wasmView file
•path = viewer/wasm/typst/typst_ts_renderer_bg.wasm kind = wasm_module sizeBytes = 972425 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

viewer/wasm/typst/typst_ts_renderer_bg.wasmView on unpkg
viewer/wasm/typst/fonts/NewCMMath-Regular.otfView file
•path = [redacted]-Regular.otf kind = high_entropy_blob sizeBytes = 1150844 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

viewer/wasm/typst/fonts/NewCMMath-Regular.otfView on unpkg
viewer/vendor/pdf/pdf.worker.mjsView file
•path = viewer/vendor/pdf/pdf.worker.mjs kind = oversized_source_file sizeBytes = 2360132 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

viewer/vendor/pdf/pdf.worker.mjsView on unpkg

Findings

3 High7 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobviewer/wasm/typst/fonts/NewCMMath-Regular.otf
HighOversized Source Fileviewer/vendor/pdf/pdf.worker.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireviewer/wasm/cad/libredwg-web.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Wasm Moduleviewer/wasm/typst/typst_ts_renderer_bg.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/assets/pptx.worker-BPX7kcb_.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings