@flowengage/react-chatbot@8.0.20-test: Suspicious npm security

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.93 MB of source, external domains: aomediacodec.github.io, api.elevenlabs.io, be-flowengage-dev.oslabs.app, cdn.jsdelivr.net, fonts.googleapis.com, github.com, motion.dev, react.dev, socket.io, www.google.com, www.w3.org

Source & flagged code

3 flagged

dist/flowengage-react-chatbot.mjsView file

8509patternName = generic_password severity = medium line = 8509 matchedText = let t = ...\n";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/flowengage-react-chatbot.mjsView on unpkg · L8509

dist/flowengage-embed.jsView file

8`+e.stack}}var je=Object.prototype.hasOwnProperty,Me=t.unstable_scheduleCallback,Ne=t.unstable_cancelCallback,Pe=t.unstable_shouldYield,Fe=t.unstable_requestPaint,Ie=t.unstable_now... L9: `).replace(Fd,``)}function Ld(e,t){return t=Id(t),Id(e)===t}function Rd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||tn(e,r):(typeof... L10: `:case`\r`:case` `:case` `:continue;default:throw Error(`invalid base64 string.`)}switch(i){case 0:o=a,i=1;break;case 1:n[r++]=o<<2|(a&48)>>4,o=a,i=2;break;case 2:n[r++]=(o&15)<<4|...

High

Child Process

Package source references child process execution.

dist/flowengage-embed.jsView on unpkg · L8

1var FlowEngage=(function(){var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.has... L2: at`)?` (<anonymous>)`:-1<e.stack.indexOf(`@`)?`@unknown:0:0`:``}return` ... L8: `+e.stack}}var je=Object.prototype.hasOwnProperty,Me=t.unstable_scheduleCallback,Ne=t.unstable_cancelCallback,Pe=t.unstable_shouldYield,Fe=t.unstable_requestPaint,Ie=t.unstable_now... L9: `).replace(Fd,``)}function Ld(e,t){return t=Id(t),Id(e)===t}function Rd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||tn(e,r):(typeof... L10: `:case`\r`:case` `:case` `:continue;default:throw Error(`invalid base64 string.`)}switch(i){case 0:o=a,i=1;break;case 1:n[r++]=o<<2|(a&48)>>4,o=a,i=2;break;case 2:n[r++]=(o&15)<<4|...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/flowengage-embed.jsView on unpkg · L1

Source & flagged code

3 flagged · loading source

dist/flowengage-react-chatbot.mjsView file

8509patternName = generic_password severity = medium line = 8509 matchedText = let t = ...\n";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/flowengage-react-chatbot.mjsView on unpkg · L8509

dist/flowengage-embed.jsView file

8`+e.stack}}var je=Object.prototype.hasOwnProperty,Me=t.unstable_scheduleCallback,Ne=t.unstable_cancelCallback,Pe=t.unstable_shouldYield,Fe=t.unstable_requestPaint,Ie=t.unstable_now... L9: `).replace(Fd,``)}function Ld(e,t){return t=Id(t),Id(e)===t}function Rd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||tn(e,r):(typeof... L10: `:case`\r`:case` `:case` `:continue;default:throw Error(`invalid base64 string.`)}switch(i){case 0:o=a,i=1;break;case 1:n[r++]=o<<2|(a&48)>>4,o=a,i=2;break;case 2:n[r++]=(o&15)<<4|...

High

Child Process

Package source references child process execution.

dist/flowengage-embed.jsView on unpkg · L8

1var FlowEngage=(function(){var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.has... L2: at`)?` (<anonymous>)`:-1<e.stack.indexOf(`@`)?`@unknown:0:0`:``}return` ... L8: `+e.stack}}var je=Object.prototype.hasOwnProperty,Me=t.unstable_scheduleCallback,Ne=t.unstable_cancelCallback,Pe=t.unstable_shouldYield,Fe=t.unstable_requestPaint,Ie=t.unstable_now... L9: `).replace(Fd,``)}function Ld(e,t){return t=Id(t),Id(e)===t}function Rd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||tn(e,r):(typeof... L10: `:case`\r`:case` `:case` `:continue;default:throw Error(`invalid base64 string.`)}switch(i){case 0:o=a,i=1;break;case 1:n[r++]=o<<2|(a&48)>>4,o=a,i=2;break;case 2:n[r++]=(o&15)<<4|...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/flowengage-embed.jsView on unpkg · L1

Findings

2 High5 Medium5 Low

HighChild Processdist/flowengage-embed.js

HighSame File Env Network Executiondist/flowengage-embed.js

MediumSecret Patterndist/flowengage-react-chatbot.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings