registry / @itfin/components / 2.0.113

@itfin/components@2.0.113

``` npm install ```

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 270 file(s), 9.01 MB of source, external domains: app.excalidraw.com, blog.excalidraw.com, bpmn.io, discord.gg, docs.excalidraw.com, example.com, excalidraw-room-persistence.firebaseio.com, github.com, img.freepik.com, json.excalidraw.com, libraries.excalidraw.com, mozilla.github.io, player.vimeo.com, plus.excalidraw.com, portal.excalidraw.com, twitter.com, unpkg.com, us-central1-excalidraw-room-persistence.cloudfunctions.net, www.omg.org, www.unpkg.com, www.w3.org, www.youtube.com

Source & flagged code

5 flagged

src/components/editor/tools/drawing/excalidraw.production.min.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = !functio...}));

High

High Secret

Package contains a high-severity secret pattern.

src/components/editor/tools/drawing/excalidraw.production.min.jsView on unpkg · L2

2patternName = google_api_key severity = high line = 2 matchedText = !functio...}));

High

Secret Pattern

Google API key in src/components/editor/tools/drawing/excalidraw.production.min.js

src/components/editor/tools/drawing/excalidraw.production.min.jsView on unpkg · L2

src/directives/sticky.jsView file

Lines 242-282javascript

242

243 getHeight() {

244 return this.el.getBoundingClientRect().height;

245 }

246

247 getPlaceholderElRect() {

248 return this.placeholderEl.getBoundingClientRect();

249 }

250

251 getContainerElRect() {

252 return this.containerEl.getBoundingClientRect();

253 }

254

255 getAttribute(name) {

256 const expr = this.el.getAttribute(name);

257 let result = undefined;

258 if (expr) {

259 if (this.vm[expr]) {

260 result = this.vm[expr];

261 } else {

262 try {

263 result = eval(`(${expr})`);

264 } catch (error) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/directives/sticky.jsView on unpkg · L262

265 result = expr;

266 }

267 }

268 }

269 return result;

270 }

271}

272

273export default {

274 inserted(el, bind, vnode) {

275 if (typeof bind.value === 'undefined' || bind.value) {

276 el[namespace] = new Sticky(el, vnode.context);

277 el[namespace].doBind();

278 }

279 },

280 unbind(el, bind, vnode) {

281 if (el[namespace]) {

282 el[namespace].doUnbind();

src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmapView file

•path = src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmap kind = high_entropy_blob sizeBytes = 33974 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmapView on unpkg

src/components/pdf-viewer/pdfjs-dist/lib/test/unit/api_spec.jsView file

Lines 187-227javascript

187 var result1 = passwordNeededLoadingTask.promise.then(function () {

188 done.fail("shall fail with no password");

189 return Promise.reject(new Error("loadingTask should be rejected"));

190 }, function (

Source & flagged code

5 flagged · loading source

src/components/editor/tools/drawing/excalidraw.production.min.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = !functio...}));

High

High Secret

Package contains a high-severity secret pattern.

src/components/editor/tools/drawing/excalidraw.production.min.jsView on unpkg · L2

2patternName = google_api_key severity = high line = 2 matchedText = !functio...}));

High

Secret Pattern

Google API key in src/components/editor/tools/drawing/excalidraw.production.min.js

src/components/editor/tools/drawing/excalidraw.production.min.jsView on unpkg · L2

src/directives/sticky.jsView file

262try { L263: result = eval(`(${expr})`); L264: } catch (error) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/directives/sticky.jsView on unpkg · L262

src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmapView file

•path = src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmap kind = high_entropy_blob sizeBytes = 33974 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmapView on unpkg

src/components/pdf-viewer/pdfjs-dist/lib/test/unit/api_spec.jsView file

207patternName = generic_password severity = medium line = 207 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in src/components/pdf-viewer/pdfjs-dist/lib/test/unit/api_spec.js

src/components/pdf-viewer/pdfjs-dist/lib/test/unit/api_spec.jsView on unpkg · L207

Findings

3 High3 Medium6 Low

HighHigh Secretsrc/components/editor/tools/drawing/excalidraw.production.min.js

HighShips High Entropy Blobsrc/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmap

HighSecret Patternsrc/components/editor/tools/drawing/excalidraw.production.min.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/components/pdf-viewer/pdfjs-dist/lib/test/unit/api_spec.js

LowScripts Present

LowEvalsrc/directives/sticky.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

src/components/editor/tools/drawing/excalidraw.production.min.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = !functio...}));

High

High Secret

Package contains a high-severity secret pattern.

src/components/editor/tools/drawing/excalidraw.production.min.jsView on unpkg · L2

2patternName = google_api_key severity = high line = 2 matchedText = !functio...}));

High

Secret Pattern

Google API key in src/components/editor/tools/drawing/excalidraw.production.min.js

src/components/editor/tools/drawing/excalidraw.production.min.jsView on unpkg · L2

src/directives/sticky.jsView file

Lines 242-282javascript

242

243 getHeight() {

244 return this.el.getBoundingClientRect().height;

245 }

246

247 getPlaceholderElRect() {

248 return this.placeholderEl.getBoundingClientRect();

249 }

250

251 getContainerElRect() {

252 return this.containerEl.getBoundingClientRect();

253 }

254

255 getAttribute(name) {

256 const expr = this.el.getAttribute(name);

257 let result = undefined;

258 if (expr) {

259 if (this.vm[expr]) {

260 result = this.vm[expr];

261 } else {

262 try {

263 result = eval(`(${expr})`);

264 } catch (error) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/directives/sticky.jsView on unpkg · L262

265 result = expr;

266 }

267 }

268 }

269 return result;

270 }

271}

272

273export default {

274 inserted(el, bind, vnode) {

275 if (typeof bind.value === 'undefined' || bind.value) {

276 el[namespace] = new Sticky(el, vnode.context);

277 el[namespace].doBind();

278 }

279 },

280 unbind(el, bind, vnode) {

281 if (el[namespace]) {

282 el[namespace].doUnbind();

src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmapView file

•path = src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmap kind = high_entropy_blob sizeBytes = 33974 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/pdf-viewer/pdfjs-dist/cmaps/Adobe-GB1-UCS2.bcmapView on unpkg

src/components/pdf-viewer/pdfjs-dist/lib/test/unit/api_spec.jsView file

Lines 187-227javascript

187 var result1 = passwordNeededLoadingTask.promise.then(function () {

188 done.fail("shall fail with no password");

189 return Promise.reject(new Error("loadingTask should be rejected"));

190 }, function (