registry  /  @genesislcap/design-system-configurator  /  14.481.1

@genesislcap/design-system-configurator@14.481.1

Design System Configurator App

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 47 file(s), 6.26 MB of source, external domains: ag-grid.com, cdn.jsdelivr.net, example.com, fonts.googleapis.com, github.com, json-schema.org, learn.genesis.global, raw.githubusercontent.com, www.ag-grid.com, www.colorxs.com, www.w3.org

Source & flagged code

4 flagged · loading source
dist/npm.microsoft.544.0302d65a64161504d3a1.jsView file
5782patternName = generic_password severity = medium line = 5782 matchedText = `;class ...tml`
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/npm.microsoft.544.0302d65a64161504d3a1.jsView on unpkg · L5782
4935} L4936: `,Us=o.TreeView.compose({baseName:"tree-view",template:o.treeViewTemplate,styles:qs}),_s={fastAccordion:ni,fastAccordionItem:si,fastAnchor:bi,fastAnchoredRegion:vi,fastAvatar:ki,fa... L4937: <span
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/npm.microsoft.544.0302d65a64161504d3a1.jsView on unpkg · L4935
bin/dsconfig.jsView file
2Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network L2: const fs = require('fs'); L3: const http = require('http'); L4: const path = require('path'); ... L11: L12: const APP_PATH = process.env.DS_CONFIG_PUBLIC_PATH || '/'; L13: ... L15: L16: app.use(express.json()); L17: ... L43: const getAppDetails = () => { L44: const currentDirectory = process.cwd(); L45: const packageJsonPath = path.join(currentDirectory, 'package.json');
High
Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/dsconfig.jsView on unpkg · L2
dist/main.96f24e22649731b845fd.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @genesislcap/design-system-configurator@14.476.0 matchedIdentity = npm:[redacted]:14.476.0 similarity = 0.953 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main.96f24e22649731b845fd.jsView on unpkg

Findings

2 High4 Medium7 Low
HighEntrypoint Build Divergencebin/dsconfig.js
HighPrevious Version Dangerous Deltadist/main.96f24e22649731b845fd.js
MediumSecret Patterndist/npm.microsoft.544.0302d65a64161504d3a1.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/npm.microsoft.544.0302d65a64161504d3a1.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License