@hr-components-dev/cli@1.4.4: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@hr-components-dev/cli@1.4.4: Suspicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

src/assets/amis/sdk/sdk.jsView file

1023this file except in compliance with the License. You may obtain a copy of the L1024: License at http://www.apache.org/licenses/LICENSE-2.0 L1025: ... L1032: and limitations under the License. L1033: ***************************************************************************** */function I(e,t){function n(){this.constructor=e}R(e,t),e.prototype=null===t?Object.create(t):(n.prot... L1034:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/assets/amis/sdk/sdk.jsView on unpkg · L1023

2685patternName = generic_password severity = medium line = 2685 matchedText = amis.def...}));

Medium

Secret Pattern

Package contains a possible secret pattern.

src/assets/amis/sdk/sdk.jsView on unpkg · L2685

633*/ L634: 'use strict';var aa=require("acd86e1"),ca=require("04b1536");function p(a){for(var b="https://reactjs.org/docs/error-decoder.html?invariant="+a,c=1;c<arguments.length;c++)b+="&args... L635: function ha(a,b){ea[a]=b;for(a=0;a<b.length;a++)da.add(b[a])}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/assets/amis/sdk/sdk.jsView on unpkg · L633

src/scripts/index.jsView file

5import { existsSync, symlinkSync, unlinkSync } from 'node:fs'; L6: import { spawn } from 'node:child_process'; L7: import consola from 'consola';

High

Child Process

Package source references child process execution.

src/scripts/index.jsView on unpkg · L5

79stdio: 'inherit', L80: shell: true L81: });

High

Shell

Package source references shell execution.

src/scripts/index.jsView on unpkg · L79

76// 启动开发服务器 L77: const viteProcess = spawn('npx', ['vite'], { L78: cwd: targetPackageDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/scripts/index.jsView on unpkg · L76

src/amis/components/utils/evalScope.tsView file

44// eslint-disable-next-line no-new-func L45: return new Function('instance', '_', 'axios', 'hiprint', 'hiprintConnect', 'dayjs', 'amis', `return ${express}`); L46: };

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/amis/components/utils/evalScope.tsView on unpkg · L44

src/assets/amis/sdk/iconfont.woffView file

•path = src/assets/amis/sdk/iconfont.woff kind = high_entropy_blob sizeBytes = 115860 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/amis/sdk/iconfont.woffView on unpkg

src/assets/amis/sdk/rest.jsView file

•path = src/assets/amis/sdk/rest.js kind = oversized_source_file sizeBytes = 2900743 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/assets/amis/sdk/rest.jsView on unpkg

Source & flagged code

9 flagged

src/assets/amis/sdk/sdk.jsView file

1023this file except in compliance with the License. You may obtain a copy of the L1024: License at http://www.apache.org/licenses/LICENSE-2.0 L1025: ... L1032: and limitations under the License. L1033: ***************************************************************************** */function I(e,t){function n(){this.constructor=e}R(e,t),e.prototype=null===t?Object.create(t):(n.prot... L1034:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/assets/amis/sdk/sdk.jsView on unpkg · L1023

2685patternName = generic_password severity = medium line = 2685 matchedText = amis.def...}));

Medium

Secret Pattern

Package contains a possible secret pattern.

src/assets/amis/sdk/sdk.jsView on unpkg · L2685

633*/ L634: 'use strict';var aa=require("acd86e1"),ca=require("04b1536");function p(a){for(var b="https://reactjs.org/docs/error-decoder.html?invariant="+a,c=1;c<arguments.length;c++)b+="&args... L635: function ha(a,b){ea[a]=b;for(a=0;a<b.length;a++)da.add(b[a])}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/assets/amis/sdk/sdk.jsView on unpkg · L633

src/scripts/index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3import { fileURLToPath } from 'node:url';

4import { dirname, join, resolve } from 'node:path';

5import { existsSync, symlinkSync, unlinkSync } from 'node:fs';

6import { spawn }

src/amis/components/utils/evalScope.tsView file

Lines 24-64typescript

24): Promise<{

25 data?: Record<string, string | number | boolean | null |

src/assets/amis/sdk/iconfont.woffView file

•path = src/assets/amis/sdk/iconfont.woff kind = high_entropy_blob sizeBytes = 115860 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/amis/sdk/iconfont.woffView on unpkg

src/assets/amis/sdk/rest.jsView file

•path = src/assets/amis/sdk/rest.js kind = oversized_source_file sizeBytes = 2900743 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/assets/amis/sdk/rest.jsView on unpkg