registry / @iblai/iblai-js / 1.20.17

@iblai/iblai-js@1.20.17

Unified JavaScript SDK for IBL.ai — re-exports data-layer, web-containers, and web-utils under a single package

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 925 KB of source, external domains: apis.google.com, conradmugabe.vercel.app, github.com, js.live.net, mailsac.com, www.dropbox.com, www.googleapis.com, www.w3.org

Oversized source lightweight scan

dist/web-containers/source/index.esm.js8.59 MB file, sampled 256 KB

HighEntropyStringsUrlStringsapis.google.comgithub.comjs.live.netwww.dropbox.comwww.googleapis.com

dist/web-containers/source/next/index.esm.js11.3 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsUrlStringsgithub.comwww.w3.org

Source & flagged code

4 flagged

dist/playwright/index.esm.jsView file

Lines 255-295javascript

255 }

256 catch (error) {

257 if (axios.isAxiosError(error)) {

258 console.error('Error deleting email:', ((_a = error.response) === null || _a === void 0 ? void 0 : _a.data) || error.message);

259 }

260 else {

261 console.error('Error deleting email:', error);

262 }

263 throw error;

264 }

265 }

266}

267

268async function signUpWithEmailAndPassword(page, authHost, postSignUpUrl, credentials, alreadyInSignupPage = false) {

269 logger.info('Checking for user credentials');

270 if (!credentials) {

271 const timeStamp = Date.now();

272 logger.info(`Generating credentials for test ${timeStamp}`);

273 credentials = {

274 email: `test+${timeStamp}@ibleducation.com`,

275 password: 'test-password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/playwright/index.esm.jsView on unpkg · L275

276 };

277 }

278 if (!alreadyInSignupPage) {

279 // Click on the sign up button

280 const signUpButton = page.getByRole('button', { name: 'Sign Up' });

281 await expect(signUpButton).toBeVisible({ timeout: 10000 });

282 await signUpButton.click();

283 // Wait for the sign up page to load

284 await safeWaitForURL(page, (url) => url.href.startsWith(authHost + '/account/create'), {

285 timeout: 60000,

286 });

287 }

288 // Click on the continue with Password button

289 const continueWithPasswordButton = page.getByRole('button', {

290 name: 'continue with Password',

291 });

292 await expect(continueWithPasswordButton).toBeVisible({ timeout: 10000 });

293 await continueWithPasswordButton.click();

294 // Fill in Email field

295 const emailInputField = page.getByPlaceholder('Email');

bin/ibl-mcp-server.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { createRequire } from 'module';

3import { resolve, dirname } from 'path';

4import { fileURLToPath } from 'url';

6// Resolve @iblai/mcp from this package's dependency tree

7const require = createRequire

dist/web-containers/source/next/index.esm.jsView file

•path = dist/web-containers/source/next/index.esm.js kind = oversized_source_file sizeBytes = 11814036 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-containers/source/next/index.esm.jsView on unpkg

dist/playwright/index.cjsView file

Lines 256-296javascript

256 }

257 catch (error) {

258 if (axios.isAxiosError(error)) {

259 console.error('Error deleting email:', ((_a = error.response) === null || _a === void 0 ? void 0

Source & flagged code

4 flagged · loading source

dist/playwright/index.esm.jsView file

275patternName = generic_password severity = medium line = 275 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/playwright/index.esm.jsView on unpkg · L275

bin/ibl-mcp-server.jsView file

6// Resolve @iblai/mcp from this package's dependency tree L7: const require = createRequire(import.meta.url); L8: const mcpEntry = require.resolve('@iblai/mcp');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ibl-mcp-server.jsView on unpkg · L6

dist/web-containers/source/next/index.esm.jsView file

•path = dist/web-containers/source/next/index.esm.js kind = oversized_source_file sizeBytes = 11814036 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-containers/source/next/index.esm.jsView on unpkg

dist/playwright/index.cjsView file

276patternName = generic_password severity = medium line = 276 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/playwright/index.cjs

dist/playwright/index.cjsView on unpkg · L276

Findings

1 High6 Medium3 Low

HighOversized Source Filedist/web-containers/source/next/index.esm.js

MediumSecret Patterndist/playwright/index.esm.js

MediumDynamic Requirebin/ibl-mcp-server.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/playwright/index.cjs

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/playwright/index.esm.jsView file

Lines 255-295javascript

255 }

256 catch (error) {

257 if (axios.isAxiosError(error)) {

258 console.error('Error deleting email:', ((_a = error.response) === null || _a === void 0 ? void 0 : _a.data) || error.message);

259 }

260 else {

261 console.error('Error deleting email:', error);

262 }

263 throw error;

264 }

265 }

266}

267

268async function signUpWithEmailAndPassword(page, authHost, postSignUpUrl, credentials, alreadyInSignupPage = false) {

269 logger.info('Checking for user credentials');

270 if (!credentials) {

271 const timeStamp = Date.now();

272 logger.info(`Generating credentials for test ${timeStamp}`);

273 credentials = {

274 email: `test+${timeStamp}@ibleducation.com`,

275 password: 'test-password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/playwright/index.esm.jsView on unpkg · L275

276 };

277 }

278 if (!alreadyInSignupPage) {

279 // Click on the sign up button

280 const signUpButton = page.getByRole('button', { name: 'Sign Up' });

281 await expect(signUpButton).toBeVisible({ timeout: 10000 });

282 await signUpButton.click();

283 // Wait for the sign up page to load

284 await safeWaitForURL(page, (url) => url.href.startsWith(authHost + '/account/create'), {

285 timeout: 60000,

286 });

287 }

288 // Click on the continue with Password button

289 const continueWithPasswordButton = page.getByRole('button', {

290 name: 'continue with Password',

291 });

292 await expect(continueWithPasswordButton).toBeVisible({ timeout: 10000 });

293 await continueWithPasswordButton.click();

294 // Fill in Email field

295 const emailInputField = page.getByPlaceholder('Email');

bin/ibl-mcp-server.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { createRequire } from 'module';

3import { resolve, dirname } from 'path';

4import { fileURLToPath } from 'url';

6// Resolve @iblai/mcp from this package's dependency tree

7const require = createRequire

dist/web-containers/source/next/index.esm.jsView file

•path = dist/web-containers/source/next/index.esm.js kind = oversized_source_file sizeBytes = 11814036 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-containers/source/next/index.esm.jsView on unpkg

dist/playwright/index.cjsView file

Lines 256-296javascript

256 }

257 catch (error) {

258 if (axios.isAxiosError(error)) {

259 console.error('Error deleting email:', ((_a = error.response) === null || _a === void 0 ? void 0