registry / @gatanot/qualia_web / 0.3.0

@gatanot/qualia_web@0.3.0

⚠ Under review

Qualia AI companion - Web UI (SvelteKit full-stack app)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 1.84 MB of source, external domains: api.deepseek.com, api.telegram.org, api.xiaomimimo.com, datatracker.ietf.org, fonts.googleapis.com, fonts.gstatic.com, github.com, my.site, npmjs.com, qualia.app, svelte.dev, t.me, www.w3.org

Source & flagged code

4 flagged

build/server/chunks/index.js-BDrtKeOP.jsView file

Lines 1586-1626javascript

1586 keys.push(`.get(${is_primitive(key) ? stringify_primitive(key) : '...'})`);

1587 str += `,${flatten(key)},${flatten(value)}`;

1588 keys.pop();

1589 }

1590

1591 str += ']';

1592 break;

1593

1594 case 'Int8Array':

1595 case 'Uint8Array':

1596 case 'Uint8ClampedArray':

1597 case 'Int16Array':

1598 case 'Uint16Array':

1599 case 'Float16Array':

1600 case 'Int32Array':

1601 case 'Uint32Array':

1602 case 'Float32Array':

1603 case 'Float64Array':

1604 case 'BigInt64Array':

1605 case 'BigUint64Array':

1606 case 'DataView': {

1607 /** @type {import("./types.js").TypedArray} */

1608 const typedArray = thing;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/server/chunks/index.js-BDrtKeOP.jsView on unpkg · L1606

1609 str = '["' + type + '",' + flatten(typedArray.buffer);

1610

1611 // handle subarrays

1612 if (typedArray.byteLength !== typedArray.buffer.byteLength) {

1613 // to be used with `new TypedArray(buffer, byteOffset, length)`

1614 str += `,${typedArray.byteOffset},${typedArray.length}`;

1615 }

1616

1617 str += ']';

1618 break;

1619 }

1620

1621 case 'ArrayBuffer': {

1622 /** @type {ArrayBuffer} */

1623 const arraybuffer = thing;

1624 const base64 = encode64(arraybuffer);

1625

1626 str = `["ArrayBuffer","${base64}"]`;

build/client/_app/immutable/nodes/7.DTUYdqzF.jsView file

Lines 1-10javascript

1import{A as e,C as t,D as n,E as r,G as i,J as a,K as o,L as s,M as c,O as l,R as u,S as d,T as f,U as p,V as m,W as h,a as g,at as _,c as v,d

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 70 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

build/client/_app/immutable/nodes/0.C7Xka8of.js.brView file

•path = build/client/_app/immutable/nodes/0.C7Xka8of.js.br kind = high_entropy_blob sizeBytes = 5119 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/0.C7Xka8of.js.brView on unpkg

Source & flagged code

4 flagged · loading source

build/server/chunks/index.js-BDrtKeOP.jsView file

1606case 'DataView': { L1607: /** @type {import("./types.js").TypedArray} */ L1608: const typedArray = thing;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/server/chunks/index.js-BDrtKeOP.jsView on unpkg · L1606

build/client/_app/immutable/nodes/7.DTUYdqzF.jsView file

95. 遇到需要用户确认的操作时等待确认后再执行 L10: 6. 回复简洁直接，避免不必要的前言后语`,V=n(`<section class="section svelte-1cqdm0h"><h2 class="svelte-1cqdm0h">系统提示词</h2> <p class="section-desc svelte-1cqdm0h">定义 Qualia 的角色和行为准则，将作为每条对话的 system p...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

build/client/_app/immutable/nodes/7.DTUYdqzF.jsView on unpkg · L9

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 70 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

build/client/_app/immutable/nodes/0.C7Xka8of.js.brView file

•path = build/client/_app/immutable/nodes/0.C7Xka8of.js.br kind = high_entropy_blob sizeBytes = 5119 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/0.C7Xka8of.js.brView on unpkg

Findings

1 Critical1 High5 Medium6 Low

CriticalCredential Exfiltrationbuild/client/_app/immutable/nodes/7.DTUYdqzF.js

HighShips High Entropy Blobbuild/client/_app/immutable/nodes/0.C7Xka8of.js.br

MediumDynamic Requirebuild/server/chunks/index.js-BDrtKeOP.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobbuild/client/robots.txt.br

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

build/server/chunks/index.js-BDrtKeOP.jsView file

Lines 1586-1626javascript

1586 keys.push(`.get(${is_primitive(key) ? stringify_primitive(key) : '...'})`);

1587 str += `,${flatten(key)},${flatten(value)}`;

1588 keys.pop();

1589 }

1590

1591 str += ']';

1592 break;

1593

1594 case 'Int8Array':

1595 case 'Uint8Array':

1596 case 'Uint8ClampedArray':

1597 case 'Int16Array':

1598 case 'Uint16Array':

1599 case 'Float16Array':

1600 case 'Int32Array':

1601 case 'Uint32Array':

1602 case 'Float32Array':

1603 case 'Float64Array':

1604 case 'BigInt64Array':

1605 case 'BigUint64Array':

1606 case 'DataView': {

1607 /** @type {import("./types.js").TypedArray} */

1608 const typedArray = thing;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/server/chunks/index.js-BDrtKeOP.jsView on unpkg · L1606

1609 str = '["' + type + '",' + flatten(typedArray.buffer);

1610

1611 // handle subarrays

1612 if (typedArray.byteLength !== typedArray.buffer.byteLength) {

1613 // to be used with `new TypedArray(buffer, byteOffset, length)`

1614 str += `,${typedArray.byteOffset},${typedArray.length}`;

1615 }

1616

1617 str += ']';

1618 break;

1619 }

1620

1621 case 'ArrayBuffer': {

1622 /** @type {ArrayBuffer} */

1623 const arraybuffer = thing;

1624 const base64 = encode64(arraybuffer);

1625

1626 str = `["ArrayBuffer","${base64}"]`;

build/client/_app/immutable/nodes/7.DTUYdqzF.jsView file

Lines 1-10javascript

1import{A as e,C as t,D as n,E as r,G as i,J as a,K as o,L as s,M as c,O as l,R as u,S as d,T as f,U as p,V as m,W as h,a as g,at as _,c as v,d

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 70 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

build/client/_app/immutable/nodes/0.C7Xka8of.js.brView file

•path = build/client/_app/immutable/nodes/0.C7Xka8of.js.br kind = high_entropy_blob sizeBytes = 5119 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/0.C7Xka8of.js.brView on unpkg