Loading npm security reports…

@jxsuite/compiler: Suspicious npm security report (Warn) | LPM Firewall

registry / @jxsuite/compiler / 1.1.0

@jxsuite/compiler@1.1.0

Jx static HTML compiler, island detector, and site builder

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 874 KB of source, external domains: aaa.nonexistanturl.com, bun.sh, esm.sh, example.com, github.com, json-schema.org, jxsuite.com, opencollective.com, raw.githubusercontent.com, sharp.pixelplumbing.com, www.sitemaps.org

Source & flagged code

8 flagged

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{createRequire as bH}from"node:module";var jH=Object.create;var{getPrototypeOf:EH,defineProperty:t5,getOwnPropertyNames:OH}=Object;var RH=Object.prototype.hasOwnProperty;function PH(Z){return this[Z]}var CH,SH,$1=(Z,Q,W)=>{var X=Z!=null&&typeof Z==="object";if(X){var J=Q?CH??=new WeakMap:SH??=new WeakMap,G=J.get(Z);if(G)return G}W=Z!=null?jH(EH(Z)):{};let Y=Q||!Z||!Z.__esModule?t5(W,"default",{value:Z,enumerable:!0}):W;for(let z of OH(Z))if(!RH.call(Y,z))t5(Y,z,{get:PH.bind(Z,z),enumerable:!0});if(X)J.set(Z,Y);return Y};var j=(Z,Q)=>()=>(Q||Z((Q={exports:{}}).exports,Q),Q.exports);var kH ...

3`)}var Y8=u(()=>{t1()});function pH(Z){if(!lH||!Z.includes("v"))return Z;return Z.replace(dH,(Q,W,X)=>`${W}${cH[X.toLowerCase()]??`cq${X}`}`)}function iH(Z){return Z.startsWith(":")||Z.startsWith(".")||Z.startsWith("&")||Z.startsWith("[")}function t0(Z){return Z.replaceAll(/[A-Z]/g,(Q)=>`-${Q.toLowerCase()}`)}function p0(Z){return Object.entries(Z).filter(([Q,W])=>!iH(Q)&&(W===null||typeof W!=="object")).map(([Q,W])=>`${t0(Q)}: ${pH(String(W))}

4${X.join(`

5`)}

6</style>`}function bW(Z,Q,W,X){let J=p0(Q);if(J)W.push(`${Z} { ${J} }`);for

7${q.join(`

8`)}

9}`);for(let[K,V]of Object.entries(Z.style)){if(V===null||typeof V!=="object"||Array.isArray(V))continue;if(K.startsWith("@")){let H=K.startsWith("@--")?`@media ${W[K.slice(1)]??K.slice(1)}`:K.startsWith("@(")?`@media ${K.slice(1)}`:K,B=p0(V);if(B)Q.push(`${H} { ${z} { ${B} } }`);for(let[F,A]of Object.entries(V)){if(A===null||typeof A!=="object"||Array.isArray(A))continue;if(F.startsWith("@"))continue;let M=F.startsWith("&")?F.replace("&",z):F.startsWith(":")||F.startsWith(".")||F.startsWith("[")?`

10`);if(!Z||typeof Z!=="object")return"";if(Z.$prototype==="Array")return"";if(Z.$switch){let Y=Z.tagName??

11`);return`<${X}${J}>${G}</${X}>`}function vW(Z,Q=null,W=null){let X=Z.state??{};if

12`)}function VZ(Z){return qZ(Z)}function qZ(Z){if(!Z||typeof Z!=="object")return!0;if(Array.isArray

13${G.join(`

14`)}

15}`);for(let[Y,z]of Object.entries(Q))if(Y.startsWith("@")){let q=Y.startsWith("@--")?`@media ${X[Y.slice(1)]??Y.slice(1)}`:Y.startsWith("@(")?`@media ${Y.slice(1)}`:Y;J.push(`${q} { ${Z} { ${p0(z)} } }`)}else if(Y.startsWith(":")||Y.startsWith(".")||Y.startsWith("&")||Y.startsWith("[")){let q=Y.startsWith("&")?Y.replace("&",Z):`${Z}${Y}`;J.push(`${q} { ${p0(z)} }`)}}if(W&&Array.isArray(W.children)){let G={n:0};for(let Y of W.children)M6(Y,J,X,"",G,Z)}return J.length>0?`${J.join(`

16`)}

17`:""}var V1="https://esm.sh/@vue/reactivity@3.5.32",H1="https://esm.sh/lit-html@3.3.0",UZ;var I6=u(()=>{e1();t1();Y8();y4();e1();t1();Y8();y4();UZ=new Set(["input","br","hr","img","meta","link","area","col","source"])});function W6(Z){if(Z.startsWith("\\\\?\\"))return Z;return Z.split("\\").join("/")}var nH,Q9=()=>nH;var gW=u(()=>{nH=/^win/.test(globalThis.process?globalThis.process.platform:"")});function O0(Z,Q){let W=new URL(W6(Z),"https://aaa.nonexistanturl.com"),X=new URL(W6(Q),W),J=Q.match(/(\s*)$/)?.[1]||"";if(X.hostname==="aaa.nonexistanturl.com"){let{pathname:Y,search:z,hash:q}=X;retu ...

18Cannot set "${Q}" of a non-object.`);return W}function MB(Z,Q){for(let W of Q)if(AB.has(W))throw new K4(`Error assigning $ref pointer "${Z}".

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

19Unsafe JSON Pointer token "${W}" cannot be used for assignment.`)}function rW(Z){if(h4(Z))throw Z;return Z}function IB(Z){return typeof Z=="string"&&p6.parse(Z).length==0}function aW(Z){return Boolean(Z.path&&Z.path in Z.$refs._aliases)}var N8,HB,BB,FB,LB,AB,Z4;var W9=u(()=>{D1();e0();M4();c6();N8=Symbol("null"),HB=/\//g,BB=/~/g,FB=/~1/g,LB=/~0/g,AB=new Set(["__proto__","constructor","prototype"]);Z4=p6});class X9{path;value;$refs;pathType;dynamicIdScope=!1;errors=[];constructor(Z){this.$refs=Z}addError(Z){if(this.errors===void 0)this.errors=[];let Q=this.errors.map(({footprint:W})=>W);if("err ...

20"${R0(W)}" not found.`);X.set(W,Q)}_get$Ref(Z){return Z=O0(this._root$Ref.path,Z),this._getRef(Z)}_add(Z){let Q=R0(Z),W=new w0(this);return W.path=Q,this._$refs[Q]=W,this._root$Ref=this._root$Ref||W,W}_addAlias(Z,Q,W,X=!1){let J=R0(Z);if(!J||this._$refs[J]||this._aliases[J])return this._$refs[J]||this._aliases[J];let G=new w0(this);return G.path=J,G.pathType=W,G.value=Q,G.dynamicIdScope=X,this._aliases[J]=G,G}_resolve(Z,Q,W,X,J=!0){let G=O0(this._root$Ref.path,Z),Y=this._getRef(G);if(!Y)throw Error(`Error resolving $ref pointer "${Z}".

21"${R0(G)}" not found.`);return Y.resolve(G,W,Z,Q,X,J)}_$refs={};_aliases={};_root$Ref;constructor(){this.circular=!1,this._$refs={},this._aliases={},this._root$Ref=null}toJSON=this.values;_getRef(Z){let Q=R0(Z);return this._$refs[Q]||this._aliases[Q]}}function oW(Z,Q){let W=Object.keys(Z);if(Q=Array.isArray(Q[0])?Q[0]:Array.prototype.slice.call(Q),Q.length>0&&Q[0])W=W.filter((X)=>{return Q.includes(Z[X].pathType)});return W.map((X)=>{return{encoded:X,decoded:Z[X].pathType==="file"?M1(X,!0):X}})}var tW=u(()=>{D1();e0()});function LZ(Z){return Object.keys(Z||{}).filter((Q)=>{return typeof Z[Q]== ...

Long lines were clipped for display.

Lines 191-237javascript

191`)}function VF(Z){if(!Z)return"Object";if(typeof Z==="string")return Z;if(Z.$ref){let Q=Z.$ref.match(/([A-Za-z0-9_]+)\.class\.json/);return Q?Q[1]:"Object"}return"Object"}function fJ(Z){return Z.map((Q)=>{if(Q.$ref)return Q.$ref.split("/").pop();let W=Q.identifier??Q.name;return typeof W==="string"?W:"arg"}).join(", ")}function HF(Z){if(!Z)return[""];return Array.isArray(Z)?Z:[Z]}function BF(Z){return(Array.isArray(Z.body)?Z.body.join(`

192`):Z.body??"").includes("await ")}import{readFileSync as FF}from"node:fs";async function B7(Z,Q={}){let{title:W="Jx App",reactivitySrc:X=V1,litHtmlSrc:J=H1,projectStyle:G=null}=Q,Y;if(typeof Z==="string"){let z=FF(Z,"utf8");if(Z.endsWith(".json"))Y=w6(z,Z);else{let{extname:q}=await import("node:path"),K=q(Z).toLowerCase(),V=Q.formats?.byExtension?.(K,"parse");if(!V){let{unknownFormatError:H}=await Promise.resolve().then(() => (E6(),z7));throw H(Z,K)}Y=await V.call("parse",z)}}else Y=Z;if(CW(Y)){let{compileClassJson:z}=await Promise.resolve().then(() => hJ),q=z(Y,Q),K=typeof Z==="string"?Z.repl ...

193<html lang="en">

194<head>

195 <meta charset="utf-8">

196 <meta name="viewport" content="width=device-width, initial-scale=1">

197 <title>${

src/shared.tsView file

Lines 326-366typescript

326 return evaluateExpression(node, scope, null, { args });

327 });

328 } else if (isMutating(node.operator)) {

329 setOwnScopeValue(scope, key, (s: Record<string

dist/compiler.jsView file

Lines 31-71javascript

31`,A?1+D:D);else if(T===Y){if(A)z.result+=`

32`}break}if(w)if(b(_))j=!0,z.result+=Z.repeat(`

33`,A?1+D:D);else if(j)j=!1,z.result+=Z.repeat(`

34`,D+1);else if(D===0){if(A)z.result+=" "}else z.result+=Z.repeat(`

35`,D);else z.result+=Z.repeat(`

36`,A?1+D:D);A=!0,x=!0,D=0;let R=z.position;while(!P(_)&&_!==0)_=z.input.charCodeAt(++z.position);M2(z,R,z.position,!1)}return!0}function b2(z,$){let{tag:w,anchor:T}=z,A=[],x=!1;if(z.firstTabInLine!==-1)return!1;if(z.anchor!==null)x2(z,z.anchor,A);let H=z.input.charCodeAt(z.position);while(H!==0){if(z.firstTabInLine!==-1)z.position=z.firstTabInLine,v(z,"tab characters must not be used in indentation");if(H!==45)break;let D=z.input.charCodeAt(z.position+1);if(!m(D))break;if(x=!0,z.position++,t(z,!0,-1)){if(z.lineIndent<=$){A.push(null),H=z.input.charCodeAt(z.position);continue}}let j=z.line;if(g2 ...

37`;if(z.charCodeAt

src/site/image-optimizer.tsView file

Lines 1-33typescript

1/**

2 * Image-optimizer.js — Sharp wrapper for image resizing and format conversion.

3 *

4 * Generates responsive image variants (WebP, AVIF) at configured breakpoint widths. Returns an

5 * ImageManifest describing all generated variants with their output paths.

6 */

8import { createHash } from "node:crypto";

9import { errorMessage }

Source & flagged code

8 flagged · loading source

217SPDX-License-Identifier: Apache-2.0 L218: */$={defined:UG,object:iF,plainObject:nF,fn:rF,bool:aF,buffer:sF,typedArray:oF,arrayBuffer:tF,string:eF,number:ZL,integer:QL,inRange:WL,inArray:XL,invalidParameterError:JL,nativeEr... L219: Copyright 2013 Lovell Fuller and others.

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L217

212</html>`;return{files:[V],html:B}}return U7(Y,{litHtmlSrc:J,projectStyle:G,reactivitySrc:X,title:W})}async function Ax(Z,Q){let[W,X]=await Promise.all([B7(Z),$9(Z)]),{writeFileSync... L213: `,patched:!0}}function lJ(Z,Q){for(let[W,X]of Object.entries(Q)){let J=Z[W];if(Array.isArray(X)){Z[W]=LF(Array.isArray(J)?J:[],X);continue}if(b8(X)){if(b8(J))lJ(J,X);else if(J===vo... L214: `)){let J=X.trim();if(J===""||J.startsWith("#"))continue;let G=J.indexOf("=");if(G===-1)continue;let Y=J.slice(0,G).trim(),z=J.slice(G+1).trim();if(z.startsWith('"')&&z.endsWith('"... ... L217: SPDX-License-Identifier: Apache-2.0 L218: */$={defined:UG,object:iF,plainObject:nF,fn:rF,bool:aF,buffer:sF,typedArray:oF,arrayBuffer:tF,string:eF,number:ZL,integer:QL,inRange:WL,inArray:XL,invalidParameterError:JL,nativeEr... L219: Copyright 2013 Lovell Fuller and others.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L212

211</body> L212: </html>`;return{files:[V],html:B}}return U7(Y,{litHtmlSrc:J,projectStyle:G,reactivitySrc:X,title:W})}async function Ax(Z,Q){let[W,X]=await Promise.all([B7(Z),$9(Z)]),{writeFileSync... L213: `,patched:!0}}function lJ(Z,Q){for(let[W,X]of Object.entries(Q)){let J=Z[W];if(Array.isArray(X)){Z[W]=LF(Array.isArray(J)?J:[],X);continue}if(b8(X)){if(b8(J))lJ(J,X);else if(J===vo... ... L217: SPDX-License-Identifier: Apache-2.0 L218: */$={defined:UG,object:iF,plainObject:nF,fn:rF,bool:aF,buffer:sF,typedArray:oF,arrayBuffer:tF,string:eF,number:ZL,integer:QL,inRange:WL,inArray:XL,invalidParameterError:JL,nativeEr... L219: Copyright 2013 Lovell Fuller and others.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L211

1#!/usr/bin/env node L2: import{createRequire as bH}from"node:module";var jH=Object.create;var{getPrototypeOf:EH,defineProperty:t5,getOwnPropertyNames:OH}=Object;var RH=Object.prototype.hasOwnProperty;func... L3: `)}var Y8=u(()=>{t1()});function pH(Z){if(!lH||!Z.includes("v"))return Z;return Z.replace(dH,(Q,W,X)=>`${W}${cH[X.toLowerCase()]??`cq${X}`}`)}function iH(Z){return Z.startsWith(":"... L4: ${X.join(` ... L16: `)} L17: `:""}var V1="https://esm.sh/@vue/reactivity@3.5.32",H1="https://esm.sh/lit-html@3.3.0",UZ;var I6=u(()=>{e1();t1();Y8();y4();e1();t1();Y8();y4();UZ=new Set(["input","br","hr","img",... L18: Cannot set "${Q}" of a non-object.`);return W}function MB(Z,Q){for(let W of Q)if(AB.has(W))throw new K4(`Error assigning $ref pointer "${Z}". ... L93: } L94: })`}var W7=u(()=>{LJ();I6()});function D6(Z){return Z instanceof Error?Z.message:String(Z)}function X7(Z,Q,W){let X;try{X=JSON.parse(Z)}catch(J){throw Error(`Failed to parse ${W} a... L95: <html lang="en"> ... L211: </body> L212: </html>`;return{files:[V],html:B}}return U7(Y,{litHtmlSrc:J,projectStyle:G,reactivitySrc:X,title:W})}async function Ax(Z,Q){let[W,X]=await Promise.all([B7(Z),$9(Z)]),{writeFileSync...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code