registry / @hubsync/esign-web-sdk / 6.9.55

@hubsync/esign-web-sdk@6.9.55

⚠ Under review

Verdocs Web SDK

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 578 file(s), 13.5 MB of source, external domains: api.verdocs.com, app.verdocs.com, beta.verdocs.com, chat.stenciljs.com, date-fns.org, developer.mozilla.org, en.wikipedia.org, fonts.gstatic.com, github.com, polymer.github.io, stage-api.verdocs.com, stage.verdocs.com, stenciljs.com, unleash.verdocs.com, verdocs.com, www.google.com, www.unicode.org, www.w3.org

Source & flagged code

2 flagged

dist/index.cjs.jsView file

Lines 1-2javascript

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

Lines 1-30javascript

2'use strict';

3(function () {

4 var currentScript = document.currentScript;

6 // Safari 10 support type="module" but still download and executes the nomodule script

7 if (!currentScript || !currentScript.hasAttribute('nomodule') || !('onbeforeload' in currentScript)) {

9 /**

10 * core-js 3.6.5

11 * https://github.com/zloirock/core-js

12 * License: http://rock.mit-license.org

14 */

15!function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.exports}e.m=t,e.c=n,e.d=function(t,n

17//!fetch 3.0.0, global "this" must be replaced with "window"

18// IIFE version

19!function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){return!1}}(),n="FormData"in self,i="ArrayBuffer"

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

21(function(){

22 /*

24 This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt

25 The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt

26 The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt

27 Code distributed by Google as part of the polymer project is also

28 subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt

29 */

30 'use strict';var aa=new Set("annotation-xml color-profile font-face font-face-src font-face-uri font-face-format font-face-name missing-glyph".split(" "));function g(a){var b=aa.has(a);a=/^[a-z][.0-9_a-z]*-[\-.0-9_a-z]*$/.test(a);return!b&&a}function l(a){

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

Findings

1 Critical4 Medium4 Low

CriticalBuiltin Api Tampering Exfiltrationdist/verdocs-web-sdk/verdocs-web-sdk.js

MediumDynamic Requiredist/index.cjs.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.cjs.jsView file

Lines 1-2javascript

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

Lines 1-30javascript

2'use strict';

3(function () {

4 var currentScript = document.currentScript;

6 // Safari 10 support type="module" but still download and executes the nomodule script

7 if (!currentScript || !currentScript.hasAttribute('nomodule') || !('onbeforeload' in currentScript)) {

9 /**

10 * core-js 3.6.5

11 * https://github.com/zloirock/core-js

12 * License: http://rock.mit-license.org

14 */

17//!fetch 3.0.0, global "this" must be replaced with "window"

18// IIFE version

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

21(function(){

22 /*

24 This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt

25 The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt

26 The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt

27 Code distributed by Google as part of the polymer project is also

28 subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt

29 */

Long lines were clipped for display.