@gentbajko/slopify@3.1.1: Unknown npm security report (Allow) | LPM Firewall

Loading npm security reports…

@gentbajko/slopify@3.1.1: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/web/assets/pdf-CViHVF9X.jsView file

1import{t as e}from"./index-DBLI2o4h.js";var t=typeof process==`object`&&process+``==`[object process]`&&!process.versions.nw&&!(process.versions.electron&&process.type&&process.typ... L2: struct Uniforms {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/assets/pdf-CViHVF9X.jsView on unpkg · L1

dist/web/assets/index-DBLI2o4h.jsView file

246contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/index-DBLI2o4h.jsView on unpkg · L246

dist/extension/slopify-studio-firefox.zipView file

•path = dist/extension/slopify-studio-firefox.zip kind = high_entropy_blob sizeBytes = 35877 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/extension/slopify-studio-firefox.zipView on unpkg

•path = dist/extension/slopify-studio-firefox.zip kind = compressed_blob sizeBytes = 35877 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/extension/slopify-studio-firefox.zipView on unpkg

•path = dist/extension/slopify-studio-firefox.zip kind = nested_archive_needs_inspection sizeBytes = 35877 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/extension/slopify-studio-firefox.zipView on unpkg

dist/adapters/alignment/text.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapters/alignment/text.js#virtual:normalized:round1View on unpkg

dist/adapters/ffmpeg.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/adapters/ffmpeg.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapters/ffmpeg.jsView on unpkg

dist/edge/open-browser.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/edge/open-browser.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/edge/open-browser.jsView on unpkg

dist/updater/forward.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/updater/forward.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/updater/forward.jsView on unpkg

Source & flagged code

9 flagged

dist/web/assets/pdf-CViHVF9X.jsView file

Lines 1-21javascript

1import{t as e}from"./index-DBLI2o4h.js";var t=typeof process==`object`&&process+``==`[object process]`&&!process.versions.nw&&!(process.versions.electron&&process.type&&process.type!==`browser`),n=[1/0,1/0,-1/0,-1/0],r=new Float32Array(n),i=[.001,0,0,.001,0,0],a=`http://www.w3.org/2000/svg`,o={ANY:1,DISPLAY:2,PRINT:4,SAVE:8,ANNOTATIONS_FORMS:16,ANNOTATIONS_STORAGE:32,ANNOTATIONS_DISABLE:64,IS_EDITING:128,OPLIST:256},s={DISABLE:0,ENABLE:1,ENABLE_FORMS:2,ENABLE_STORAGE:3},c=`pdfjs_internal_id_`,l=`pdfjs_internal_editor_`,u={DISABLE:-1,NONE:0,FREETEXT:3,HIGHLIGHT:9,STAMP:13,INK:15,POPUP:16,SIGNAT ...

2struct Uniforms {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/assets/pdf-CViHVF9X.jsView on unpkg · L1

3 offsetX : f32,

4 offsetY : f32,

5 scaleX : f32,

6 scaleY : f32,

7 paddedWidth : f32,

8 paddedHeight : f32,

9 borderSize : f32,

10 _pad : f32,

11};

12

13@group(0) @binding(0) var<uniform> u : Uniforms;

14

15struct VertexInput {

16 @location(0) position : vec2<f32>,

17 @location(1) color : vec4<f32>,

18};

19

20struct VertexOutput {

21 @builtin(position) position : vec4<f32>,

Long lines were clipped for display.

dist/web/assets/index-DBLI2o4h.jsView file

246contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/index-DBLI2o4h.jsView on unpkg · L246

dist/extension/slopify-studio-firefox.zipView file

•path = dist/extension/slopify-studio-firefox.zip kind = high_entropy_blob sizeBytes = 35877 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/extension/slopify-studio-firefox.zipView on unpkg

•path = dist/extension/slopify-studio-firefox.zip kind = compressed_blob sizeBytes = 35877 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/extension/slopify-studio-firefox.zipView on unpkg

•path = dist/extension/slopify-studio-firefox.zip kind = nested_archive_needs_inspection sizeBytes = 35877 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/extension/slopify-studio-firefox.zipView on unpkg

dist/adapters/alignment/text.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapters/alignment/text.js#virtual:normalized:round1View on unpkg

dist/adapters/ffmpeg.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/adapters/ffmpeg.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapters/ffmpeg.jsView on unpkg

dist/edge/open-browser.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/edge/open-browser.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/edge/open-browser.jsView on unpkg

dist/updater/forward.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/updater/forward.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/updater/forward.jsView on unpkg