@flyfish-group/file-viewer-web@2.2.2: Suspicious npm security | LPM Firewall

Loading npm security reports…

@flyfish-group/file-viewer-web@2.2.2: Suspicious npm security | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/copy-assets.mjs --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/copy-assets.mjs --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/assets/pptx.worker-BPX7kcb_.jsView file

3045}, L.setImmediate = function(M) { L3046: typeof M != "function" && (M = new Function("" + M)); L3047: for (var J = new Array(arguments.length - 1), se = 0; se < J.length; se++) J[se] = arguments[se + 1];

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pptx.worker-BPX7kcb_.jsView on unpkg · L3045

viewer/wasm/cad/libredwg-web.jsView file

7L8: var Module=moduleArg;var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject});var ENVIRONM... L9:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

viewer/wasm/cad/libredwg-web.jsView on unpkg · L7

viewer/wasm/typst/typst_ts_renderer_bg.wasmView file

•path = viewer/wasm/typst/typst_ts_renderer_bg.wasm kind = wasm_module sizeBytes = 972425 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

viewer/wasm/typst/typst_ts_renderer_bg.wasmView on unpkg

viewer/wasm/typst/fonts/NewCMMath-Regular.otfView file

•path = [redacted]-Regular.otf kind = high_entropy_blob sizeBytes = 1150844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

viewer/wasm/typst/fonts/NewCMMath-Regular.otfView on unpkg

viewer/vendor/pdf/pdf.worker.mjsView file

•path = viewer/vendor/pdf/pdf.worker.mjs kind = oversized_source_file sizeBytes = 2139216 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

viewer/vendor/pdf/pdf.worker.mjsView on unpkg

viewer/wasm/model/occt-import-js.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @flyfish-group/file-viewer-web@2.1.25 matchedIdentity = npm:[redacted]:2.1.25 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

viewer/wasm/model/occt-import-js.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 60-83json

60 "file-viewer-copy-assets": "./scripts/copy-assets.mjs"

61 },

62 "files": [

63 "dist",

64 "scripts/copy-assets.mjs",

65 "viewer",

66 "README.md",

67 "README.en.md"

68 ],

69 "dependencies": {

70 "@file-viewer/web": "2.2.2"

71 },

72 "devDependencies": {

73 "@types/node": "^25.8.0",

74 "typescript": "^6.0.3",

75 "vite": "^8.0.16"

76 },

77 "license": "Apache-2.0",

78 "scripts": {

79 "build": "tsc -b tsconfig.json && node ../../../scripts/build-web-iife.mjs packages/compat/web",

80 "postinstall": "node ./scripts/copy-assets.mjs --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L80

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L80

81 "type-check": "tsc -b tsconfig.json"

82 }

83}

dist/assets/pptx.worker-BPX7kcb_.jsView file

3045}, L.setImmediate = function(M) { L3046: typeof M != "function" && (M = new Function("" + M)); L3047: for (var J = new Array(arguments.length - 1), se = 0; se < J.length; se++) J[se] = arguments[se + 1];

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pptx.worker-BPX7kcb_.jsView on unpkg · L3045

viewer/wasm/cad/libredwg-web.jsView file

Lines 1-16javascript

1var createModule = (() => {

2 var _scriptName = import.meta.url;

3

4 return (

5async function(moduleArg

viewer/wasm/typst/typst_ts_renderer_bg.wasmView file

•path = viewer/wasm/typst/typst_ts_renderer_bg.wasm kind = wasm_module sizeBytes = 972425 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

viewer/wasm/typst/typst_ts_renderer_bg.wasmView on unpkg

viewer/wasm/typst/fonts/NewCMMath-Regular.otfView file

•path = [redacted]-Regular.otf kind = high_entropy_blob sizeBytes = 1150844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

viewer/wasm/typst/fonts/NewCMMath-Regular.otfView on unpkg

viewer/vendor/pdf/pdf.worker.mjsView file

•path = viewer/vendor/pdf/pdf.worker.mjs kind = oversized_source_file sizeBytes = 2139216 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

viewer/vendor/pdf/pdf.worker.mjsView on unpkg

viewer/wasm/model/occt-import-js.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @flyfish-group/file-viewer-web@2.1.25 matchedIdentity = npm:[redacted]:2.1.25 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

viewer/wasm/model/occt-import-js.jsView on unpkg