registry / @jxsuite/compiler / 0.34.0

@jxsuite/compiler@0.34.0

Jx static HTML compiler, island detector, and site builder

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 665 KB of source, external domains: aaa.nonexistanturl.com, esm.sh, example.com, github.com, opencollective.com, sharp.pixelplumbing.com, www.sitemaps.org

Source & flagged code

8 flagged

dist/cli.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2import{createRequire as MX}from"node:module";var UX=Object.create;var{getPrototypeOf:KX,defineProperty:N1,getOwnPropertyNames:VX}=Object;var BX=Object.prototype.hasOwnProperty;function HX(Z){return this[Z]}var $X,FX,g4=(Z,W,X)=>{var Q=Z!=null&&typeof Z==="object";if(Q){var J=W?$X??=new WeakMap:FX??=new WeakMap,G=J.get(Z);if(G)return G}X=Z!=null?UX(KX(Z)):{};let Y=W||!Z||!Z.__esModule?N1(X,"default",{value:Z,enumerable:!0}):X;for(let U of VX(Z))if(!BX.call(Y,U))N1(Y,U,{get:HX.bind(Z,U),enumerable:!0});if(Q)J.set(Z,Y);return Y};var n=(Z,W)=>()=>(W||Z((W={exports:{}}).exports,W),W.exports);var LX ...

3${Q.join(`

4`)}

5</style>`}function D8(Z,W,X,Q){let J=E0(W);if(J)X.push(`${Z} { ${J} }`);for(let[G,Y]of Object.entries(W)){if(Y===null||typeof Y!=="object"||Array.isArray(Y))continue;if(G.startsWith("@")){let K=G.startsWith("@--")?`@media ${Q[G.slice(1)]??G.slice(1)}`:G.startsWith("@(")?`@media ${G.slice(1)}

6${K.join(`

7`)}

8}`);for(let[V,H]of Object.entries(Z.style)){if(H===null||typeof H!=="object"||Array.isArray(H))continue;if(V.startsWith(

9`);if(!Z||typeof Z!=="object")return"";if(Z.$prototype==="Array")return"";if(Z.$switch){let Y=Z.tagName??"div",U=z4(Z,W),K=$0(Z.$switch,W),V=K==null?void 0:Z.cases?.[String(K)],H=V!==void 0&&!e0(V)?Y4(V,W,X):"";return`<${Y}${U}>${H}</${Y}>`}let Q=Z.tagName??"div";if(Q==="slot"&&X!=null)return X;let J=z4(Z,W);if(O1.has(Q))return`<${Q}${J}>`;let G="";if(Z.textContent!==void 0){let Y=$0(Z.textContent,W);G=Y!=null?Z0(String(Y)):""}else if(Z.innerHTML){let Y=$0(Z.innerHTML,W);G=Y!=null?String(Y):Z.innerHTML}else if(Array.isArray(Z.children))G=Z.children.map((Y)=>Y4(Y,W,X)).join(`

10`);return`<${Q}${J}>${G}</${Q}>`}function R8(Z,W=null,X=null){let Q=Z.state??{};if(W){Q={...Q};for(let[G,Y]of Object.entries(W))if(G in Q){let U=Q[G];Q[G]=U&&typeof U==="object"&&!Array.isArray(U)&&"default"in U?{...U,default:Y}:Y}else Q[G]=Y}let J=V4(Q,null);if(!Array.isArray(Z.children))return"";return Z.children.map((G)=>Y4(G,J,X)).join(`

11`)}function x1(Z){return E1(Z)}function E1(Z){if(!Z||typeof Z!=="object")return!0;if(Array.isArray(Z))return Z.every((W)=>E1(W));if(Z.$prototype)return!1;if(Z.$ref)return!1;if(Z.state)for(let W of Object.values(Z.state)){if(!W||typeof W!=="object")continue;let X=W;if(X.$prototype)return!1;if(X.$ref)return!1}for(let W of Object.keys(Z))if(W.startsWith("on")&&W!=="observedAttributes")return!1;if(Array.isArray(Z.children))return Z.children.every((W)=>E1(W));if(Z.children&&typeof Z.children==="object"&&Z.children.$prototype)return!1;return!0}function P8(Z,W,X=null,Q={}){let J=[];if(W&&typeof W===" ...

12${G.join(`

13`)}

14}`);for(let[Y,U]of Object.entries(W))if(Y.startsWith("@")){let K=Y.startsWith("@--")?`@media ${Q[Y.

15`)}

16`:""}var q4="https://esm.sh/@vue/reactivity@3.5.32",U4="https://esm.sh/lit-html@3.3.0",O1;var y6=c(()=>{h4();w2();X6();h4();w2();X6();O1=new Set([

17Cannot set "${W}" of a non-object.`);return X}function tX(Z,W){for(let X of W)if(oX.has(X))throw new m0(`Error assigning $ref pointer "${Z}".

18Unsafe JSON Pointer token "${X}" cannot be used for assignment.`)}function g8(Z){if(G6(Z))throw Z;return Z}function eX(Z){return typeof Z=="string"&&s6.parse(Z).length==0}function h8(Z){return Boolean(Z.path&&Z.path in Z.$refs._aliases)}var v2,iX,rX,aX,sX,oX,v0;var m4=c(()=>{A4();b0();i0();a6();v2=Symbol("null"),iX=/\//g,rX=/~/g,aX=/~1/g,sX=/~0/g,oX=new Set(["__proto__","constructor","prototype"]);v0=s6});class u4{path;value;$refs;pathType;dynamicIdScope=!1;errors=[];constructor(Z){this.$refs=Z}addError(Z){if(this.errors===void 0)this.errors=[];let W=this.errors.map(({footprint:X})=>X);if("err ...

19"${F0(X)}" not found.`);Q.set(X,W)}_get$Ref(Z){return Z=L0(this._root$Ref.path,Z),this._getRef(Z)}_add

20"${F0(Q)}" not found.`);return J.resolve(Q,X,Z,W)}_$refs={};_aliases={};_root$Ref;constructor(){this.circular=!1,this._$refs={},

21Parsed value is empty`);else return Y}catch(Y){if(!Y&&W.continueOnError)throw new C2(Z.url);else if(Y&&Y.message&&Y.message.startsWith("Error parsing"))throw Y;else if(!Y||!("error"in Y))throw SyntaxError(`Unable to parse ${Z.url}`,{cause:Y});else if(Y.error instanceof n0)throw Y.error;else throw new n0(Y.error.message,Z.url)}}function QQ(Z){return Z===void 0||typeof Z==="object"&&Object.keys(Z).length===0||typeof Z==="string"&&Z.trim().length===0||Buffer.isBuffer(Z)&&Z.length===0}var y2;var f1=c(()=>{b0();a6();i0();y2=ZQ});var c8;var l8=c(()=>{i0();c8={order:100,allowEmpty:!0,canParse:".json" ...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L15

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L15

23`+J.mark.snippet;return U+" "+Y}function Q(J,G){if(Error.call(this),this.name="YAMLException",this.reason=J,

24`+L}let D=Q(Y.buffer,V[$],H[$],Y.position,_);L+=X.repeat(" ",U.indent)+J((Y.line+1).toString(),A)+" | "+D.str+`

25`,L+=X.repeat("-",U.indent+A+3+D.pos)+`^

26`;for(let R=1;R<=U.linesAfter;R++){if($+R>=H.length)break;let x=Q(Y.buffer,V[$+R],H[$+R],Y.position-(V[$]-V[$+R]),_);L+=X.repeat(" ",U.indent)+J((Y.line+R+1).toString(),A)+" | "+x.str+`

27`}return L.replace(/\n$/,"")}W.exports=G}),x0=Y0((Z,W)=>{var X=l4(),Q=["kind","multi","resolve","construct","instanceOf","predicate","represent","representName","defaultStyle","styleAliases"],J=["scalar","sequence","mapping"];function G(U){let K={};if(U!==null)Object.keys(U).forEach(function(V){U[V].forEach(function(H){K[String(H)]=V})});return K}function Y(U,K){if(K=K||{},Object.keys(K).forEach(function(V){if(Q.indexOf(V)===-1)throw new X('Unknown option "'+V+'" is met in definition of "'+U+'" YAML type.')}),this.options=K,this.tag=U,this.kind=K.kind||null,this.resolve=K.resolve||function(){r ...

28\r`;function J(K){if(K===null)return!1;let V=0,H=K.length,B=Q;for(

29`;case 118:return"\v";case 102:return"\f";case 114:return"\r";case 101:return"\x1B";case 32:return" ";case 34:return'"';case 47:return"/";case 92:return"\\";case 78:return"";case 95:return" ";case 76:return"\u2028";case 80:return"\u2029";default:return""}}function X0(q){if(q<=65535)return String.fromCharCode(q);return String.fromCharCode((q-65536>>10)+55296,(q-65536&1023)+56320)}function q0(q,M,w){if(M==="__proto__")Object.defineProperty(q,M,{configurable:!0,enumerable:!0,writable:!0,value:w});else q[M]=w}var Q0=Array(256),H0=Array(256);for(let q=0;q<256;q++)Q0[q]=s(q)?1:0,H0[q]=s(q);function ...

30`,M-1)}function V2(q,M,w){let j,N,k,F,I,O,T=q.kind,P=q.result,C=q.input.charCodeAt

31`,N?1+I:I);else if(j===B){if(N)q.result+=`

32`}break}if(w)if(i(P))O=!0,q.result+=X.repeat(`

33`,N?1+I:I);else if(O)O=!1,q.result+=X.repeat(`

34`,I+1);else if(I===0){if(N)q.result+=" "}else q.result+=X.repeat(`

35`,I);else q.result+=X.repeat(`

Long lines were clipped for display.

Lines 184-228javascript

184`)}function nQ(Z){if(!Z)return"Object";if(typeof Z==="string")return Z;if(Z.$ref){let W=Z.$ref.match(/([A-Za-z0-9_]+)\.class\.json/);return W?W[1]:"Object"}return"Object"}function J9(Z){return Z.map((W)=>{if(W.$ref)return W.$ref.split("/").pop();let X=W.identifier??W.name;return typeof X==="string"?X:"arg"}).join(", ")}function iQ(Z){if(!Z)return[""];return Array.isArray(Z)?Z:[Z]}function rQ(Z){return(Array.isArray(Z.body)?Z.body.join(`

185`):Z.body??"").includes("await ")}import{readFileSync as aQ}from"node:fs";async function V3(Z,W={}){let{title:X="Jx App",reactivitySrc:Q=q4,litHtmlSrc:J=U4,projectStyle:G=null}=W,Y;if(typeof Z==="string"){let U=aQ(Z,"utf8");if(Z.endsWith(".json"))Y=g6(U,Z);else{let{extname:K}=await import("node:path"),V=K(Z).toLowerCase(),H=W.formats?.byExtension?.(V,"parse");if(!H){let{unknownFormatError:B}=await Promise.resolve().then(() => (M4(),J3));throw B(Z,V)}Y=await H.call("parse",U)}}else Y=Z;if(I8(Y)){let{compileClassJson:U}=await Promise.resolve().then(() => G9),K=U(Y,W),V=typeof Z==="string"?Z.repl ...

186<html lang="en">

187<head>

188 <meta charset="utf-8">

189 <meta name="viewport" content="width=device-width, initial-scale=1">

190 <title>${

src/shared.tsView file

Lines 277-317typescript

277 if (typeof def === "string" && isTemplateString(def)) {

278 defineLazyScopeValue(scope, key, () => evaluateStaticTemplate(def, scope));

279 continue;

280 }

dist/compiler.jsView file

Lines 30-70javascript

30`,A?1+D:D);else if(T===F){if(A)z.result+=`

31`}break}if(O)if(f(w))j=!0,z.result+=W.repeat(`

32`,A?1+D:D);else if(j)j=!1,z.result+=W.repeat(`

33`,D+1);else if(D===0){if(A)z.result+=" "}else z.result+=W.repeat(`

34`,D);else z.result+=W.repeat(`

35`,A?1+D:D);A=!0,P=!0,D=0;let N=z.position;while(!u(w)&&w!==0)w=z.input.charCodeAt(++z.position);U2(z,N,z.position,!1)}return!0}function P2(z,$){let{tag:O,anchor:T}=z,A=[],P=!1;if(z.firstTabInLine!==-1)return!1;if(z.anchor!==null)N2(z,z.anchor,A);let K=z.input.charCodeAt(z.position);while(K!==0){if(z.firstTabInLine!==-1)z.position=z.firstTabInLine,g(z,"tab characters must not be used in indentation");if(K!==45)break;if(!y(z.input.charCodeAt(z.position+1)))break;if(P=!0,z.position++,r(z,!0,-1)){if(z.lineIndent<=$){A.push(null),K=z.input.charCodeAt(z.position);continue}}let D=z.line;if(x2(z,$,U,! ...

36`;if(z.charCodeAt

src/site/image-optimizer.tsView file

Lines 1-33typescript

1/**

2 * Image-optimizer.js — Sharp wrapper for image resizing and format conversion.

3 *

4 * Generates responsive image variants (WebP, AVIF) at configured breakpoint widths. Returns an

5 * ImageManifest describing all generated variants with their output paths.

6 */

8import { createHash } from "node:crypto";

9import { errorMessage }

Source & flagged code

8 flagged · loading source

dist/cli.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code