registry / @gatanot/qualia_web / 0.1.1

@gatanot/qualia_web@0.1.1

⚠ Under review

Qualia AI companion — Web UI (SvelteKit full-stack app)

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 2.23 MB of source, external domains: api.deepseek.com, api.tavily.com, api.telegram.org, api.xiaomimimo.com, datatracker.ietf.org, fonts.googleapis.com, fonts.gstatic.com, github.com, my.site, npmjs.com, svelte.dev, t.me, www.w3.org

Oversized source lightweight scan

build/server/chunks/markdown-YyE7dFVj.js2.19 MB file, sampled 256 KB

NetworkChildProcessShellHighEntropyStringsUrlStringsgithub.com

Source & flagged code

5 flagged

build/server/chunks/index.js-CJZab21L.jsView file

Lines 325-365javascript

325 /**

326 * @param {number} status

327 * @param {T} data

328 */

329 constructor(status, data) {

330 this.status = status;

331 this.data = data;

332 }

333}

334

335//#region \0rolldown/runtime.js

336var __defProp = Object.defineProperty;

337var __exportAll = (all, no_symbols) => {

338 let target = {};

339 for (var name in all) __defProp(target, name, {

340 get: all[name],

341 enumerable: true

342 });

343 __defProp(target, Symbol.toStringTag, { value: "Module" });

344 return target;

345};

346var __require = /* @__PURE__ */ createRequire(import.meta.url);

347

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/server/chunks/index.js-CJZab21L.jsView on unpkg · L345

348const UNDEFINED = -1;

349const HOLE = -2;

350const NAN = -3;

351const POSITIVE_INFINITY = -4;

352const NEGATIVE_INFINITY = -5;

353const NEGATIVE_ZERO = -6;

354const SPARSE = -7;

355

356// The largest valid value for a JavaScript array's `length` property,

357// and the largest valid array index (one less than the max length).

358const MAX_ARRAY_LEN = 2 ** 32 - 1;

359const MAX_ARRAY_INDEX = MAX_ARRAY_LEN - 1;

360

361/** @type {Record<string, string>} */

362const escaped = {

363 '<': '\\u003C',

364 '\\': '\\\\',

365 '\b': '\\b',

build/client/_app/immutable/nodes/5.CVHYq0o4.jsView file

Lines 1-10javascript

1import{A as e,C as t,D as n,E as r,G as i,J as a,K as o,L as s,M as c,O as l,R as u,S as d,T as f,U as p,V as m,W as h,a as g,at as _,c as v,d

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

build/client/_app/immutable/nodes/3.D62SyLQS.js.gzView file

•path = build/client/_app/immutable/nodes/3.D62SyLQS.js.gz kind = high_entropy_blob sizeBytes = 5963 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/3.D62SyLQS.js.gzView on unpkg

build/server/chunks/markdown-YyE7dFVj.jsView file

•path = build/server/chunks/markdown-YyE7dFVj.js kind = oversized_source_file sizeBytes = 2299561 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/server/chunks/markdown-YyE7dFVj.jsView on unpkg

Source & flagged code

5 flagged · loading source

build/server/chunks/index.js-CJZab21L.jsView file

345}; L346: var __require = /* @__PURE__ */ createRequire(import.meta.url); L347:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/server/chunks/index.js-CJZab21L.jsView on unpkg · L345

build/client/_app/immutable/nodes/5.CVHYq0o4.jsView file

95. 遇到需要用户确认的操作时等待确认后再执行 L10: 6. 回复简洁直接，避免不必要的前言后语`,V=n(`<section class="section svelte-1cqdm0h"><h2 class="svelte-1cqdm0h">系统提示词</h2> <p class="section-desc svelte-1cqdm0h">定义 Qualia 的角色和行为准则，将作为每条对话的 system p...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

build/client/_app/immutable/nodes/5.CVHYq0o4.jsView on unpkg · L9

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

build/client/_app/immutable/nodes/3.D62SyLQS.js.gzView file

•path = build/client/_app/immutable/nodes/3.D62SyLQS.js.gz kind = high_entropy_blob sizeBytes = 5963 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/3.D62SyLQS.js.gzView on unpkg

build/server/chunks/markdown-YyE7dFVj.jsView file

•path = build/server/chunks/markdown-YyE7dFVj.js kind = oversized_source_file sizeBytes = 2299561 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/server/chunks/markdown-YyE7dFVj.jsView on unpkg

Findings

1 Critical2 High5 Medium6 Low

CriticalCredential Exfiltrationbuild/client/_app/immutable/nodes/5.CVHYq0o4.js

HighShips High Entropy Blobbuild/client/_app/immutable/nodes/3.D62SyLQS.js.gz

HighOversized Source Filebuild/server/chunks/markdown-YyE7dFVj.js

MediumDynamic Requirebuild/server/chunks/index.js-CJZab21L.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobbuild/client/robots.txt.br

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

build/server/chunks/index.js-CJZab21L.jsView file

Lines 325-365javascript

325 /**

326 * @param {number} status

327 * @param {T} data

328 */

329 constructor(status, data) {

330 this.status = status;

331 this.data = data;

332 }

333}

334

335//#region \0rolldown/runtime.js

336var __defProp = Object.defineProperty;

337var __exportAll = (all, no_symbols) => {

338 let target = {};

339 for (var name in all) __defProp(target, name, {

340 get: all[name],

341 enumerable: true

342 });

343 __defProp(target, Symbol.toStringTag, { value: "Module" });

344 return target;

345};

346var __require = /* @__PURE__ */ createRequire(import.meta.url);

347

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/server/chunks/index.js-CJZab21L.jsView on unpkg · L345

348const UNDEFINED = -1;

349const HOLE = -2;

350const NAN = -3;

351const POSITIVE_INFINITY = -4;

352const NEGATIVE_INFINITY = -5;

353const NEGATIVE_ZERO = -6;

354const SPARSE = -7;

355

356// The largest valid value for a JavaScript array's `length` property,

357// and the largest valid array index (one less than the max length).

358const MAX_ARRAY_LEN = 2 ** 32 - 1;

359const MAX_ARRAY_INDEX = MAX_ARRAY_LEN - 1;

360

361/** @type {Record<string, string>} */

362const escaped = {

363 '<': '\\u003C',

364 '\\': '\\\\',

365 '\b': '\\b',

build/client/_app/immutable/nodes/5.CVHYq0o4.jsView file

Lines 1-10javascript

1import{A as e,C as t,D as n,E as r,G as i,J as a,K as o,L as s,M as c,O as l,R as u,S as d,T as f,U as p,V as m,W as h,a as g,at as _,c as v,d

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

build/client/_app/immutable/nodes/3.D62SyLQS.js.gzView file

•path = build/client/_app/immutable/nodes/3.D62SyLQS.js.gz kind = high_entropy_blob sizeBytes = 5963 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/3.D62SyLQS.js.gzView on unpkg

build/server/chunks/markdown-YyE7dFVj.jsView file

•path = build/server/chunks/markdown-YyE7dFVj.js kind = oversized_source_file sizeBytes = 2299561 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

build/server/chunks/markdown-YyE7dFVj.jsView on unpkg