@jxsuite/compiler@1.1.0: Suspicious npm security report (Warn)

Loading npm security reports…

@jxsuite/compiler@1.1.0: Suspicious npm security report (Warn) | LPM Firewall

217SPDX-License-Identifier: Apache-2.0 L218: */$={defined:UG,object:iF,plainObject:nF,fn:rF,bool:aF,buffer:sF,typedArray:oF,arrayBuffer:tF,string:eF,number:ZL,integer:QL,inRange:WL,inArray:XL,invalidParameterError:JL,nativeEr... L219: Copyright 2013 Lovell Fuller and others.

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L217

212</html>`;return{files:[V],html:B}}return U7(Y,{litHtmlSrc:J,projectStyle:G,reactivitySrc:X,title:W})}async function Ax(Z,Q){let[W,X]=await Promise.all([B7(Z),$9(Z)]),{writeFileSync... L213: `,patched:!0}}function lJ(Z,Q){for(let[W,X]of Object.entries(Q)){let J=Z[W];if(Array.isArray(X)){Z[W]=LF(Array.isArray(J)?J:[],X);continue}if(b8(X)){if(b8(J))lJ(J,X);else if(J===vo... L214: `)){let J=X.trim();if(J===""||J.startsWith("#"))continue;let G=J.indexOf("=");if(G===-1)continue;let Y=J.slice(0,G).trim(),z=J.slice(G+1).trim();if(z.startsWith('"')&&z.endsWith('"... ... L217: SPDX-License-Identifier: Apache-2.0 L218: */$={defined:UG,object:iF,plainObject:nF,fn:rF,bool:aF,buffer:sF,typedArray:oF,arrayBuffer:tF,string:eF,number:ZL,integer:QL,inRange:WL,inArray:XL,invalidParameterError:JL,nativeEr... L219: Copyright 2013 Lovell Fuller and others.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L212

211</body> L212: </html>`;return{files:[V],html:B}}return U7(Y,{litHtmlSrc:J,projectStyle:G,reactivitySrc:X,title:W})}async function Ax(Z,Q){let[W,X]=await Promise.all([B7(Z),$9(Z)]),{writeFileSync... L213: `,patched:!0}}function lJ(Z,Q){for(let[W,X]of Object.entries(Q)){let J=Z[W];if(Array.isArray(X)){Z[W]=LF(Array.isArray(J)?J:[],X);continue}if(b8(X)){if(b8(J))lJ(J,X);else if(J===vo... ... L217: SPDX-License-Identifier: Apache-2.0 L218: */$={defined:UG,object:iF,plainObject:nF,fn:rF,bool:aF,buffer:sF,typedArray:oF,arrayBuffer:tF,string:eF,number:ZL,integer:QL,inRange:WL,inArray:XL,invalidParameterError:JL,nativeEr... L219: Copyright 2013 Lovell Fuller and others.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L211

1#!/usr/bin/env node L2: import{createRequire as bH}from"node:module";var jH=Object.create;var{getPrototypeOf:EH,defineProperty:t5,getOwnPropertyNames:OH}=Object;var RH=Object.prototype.hasOwnProperty;func... L3: `)}var Y8=u(()=>{t1()});function pH(Z){if(!lH||!Z.includes("v"))return Z;return Z.replace(dH,(Q,W,X)=>`${W}${cH[X.toLowerCase()]??`cq${X}`}`)}function iH(Z){return Z.startsWith(":"... L4: ${X.join(` ... L16: `)} L17: `:""}var V1="https://esm.sh/@vue/reactivity@3.5.32",H1="https://esm.sh/lit-html@3.3.0",UZ;var I6=u(()=>{e1();t1();Y8();y4();e1();t1();Y8();y4();UZ=new Set(["input","br","hr","img",... L18: Cannot set "${Q}" of a non-object.`);return W}function MB(Z,Q){for(let W of Q)if(AB.has(W))throw new K4(`Error assigning $ref pointer "${Z}". ... L93: } L94: })`}var W7=u(()=>{LJ();I6()});function D6(Z){return Z instanceof Error?Z.message:String(Z)}function X7(Z,Q,W){let X;try{X=JSON.parse(Z)}catch(J){throw Error(`Failed to parse ${W} a... L95: <html lang="en"> ... L211: </body> L212: </html>`;return{files:[V],html:B}}return U7(Y,{litHtmlSrc:J,projectStyle:G,reactivitySrc:X,title:W})}async function Ax(Z,Q){let[W,X]=await Promise.all([B7(Z),$9(Z)]),{writeFileSync...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

Lines 191-237javascript

191`)}function VF(Z){if(!Z)return"Object";if(typeof Z==="string")return Z;if(Z.$ref){let Q=Z.$ref.match(/([A-Za-z0-9_]+)\.class\.json/);return Q?Q[1]:"Object"}return"Object"}function fJ(Z){return Z.map((Q)=>{if(Q.$ref)return Q.$ref.split("/").pop();let W=Q.identifier??Q.name;return typeof W==="string"?W:"arg"}).join(", ")}function HF(Z){if(!Z)return[""];return Array.isArray(Z)?Z:[Z]}function BF(Z){return(Array.isArray(Z.body)?Z.body.join(`

192`):Z.body??"").includes("await ")}import{readFileSync as FF}from"node:fs";async function B7(Z,Q={}){let{title:W="Jx App",reactivitySrc:X=V1,litHtmlSrc:J=H1,projectStyle:G=null}=Q,Y;if(typeof Z==="string"){let z=FF(Z,"utf8");if(Z.endsWith(".json"))Y=w6(z,Z);else{let{extname:q}=await import("node:path"),K=q(Z).toLowerCase(),V=Q.formats?.byExtension?.(K,"parse");if(!V){let{unknownFormatError:H}=await Promise.resolve().then(() => (E6(),z7));throw H(Z,K)}Y=await V.call("parse",z)}}else Y=Z;if(CW(Y)){let{compileClassJson:z}=await Promise.resolve().then(() => hJ),q=z(Y,Q),K=typeof Z==="string"?Z.repl ...

193<html lang="en">

194<head>

195 <meta charset="utf-8">

196 <meta name="viewport" content="width=device-width, initial-scale=1">

197 <title>${q0(W)}</title>

198 <script type="importmap">

199 {

200 "imports": {

201 "@vue/reactivity": "${X}",

202 "lit-html": "${J}"

203 }

204 }

205 </script>

206 ${H}

207</head>

208<body>

209 <${z}></${z}>

210 <script type="module" src="./${z}.js"></script>

211</body>

212</html>`;return{files:[V],html:B}}return U7(Y,{litHtmlSrc:J,projectStyle:G,reactivitySrc:X,title:W})}async function Ax(Z,Q){let[W,X]=await

213`,patched:!0}}function lJ(Z,Q){for(let[W,X]of Object.entries(Q)){let J=Z[W];if(Array.isArray(X)){Z[W]=LF(Array.isArray(J)?J:[],X);continue}if(b8(X)){if(b8(J))lJ(J,X);else if(J===void 0)Z[W]=structuredClone(X);continue}if(J===void 0)Z[W]=X}}function LF(Z,Q){let W=[...Z];for(let X of Q){if(!b8(X)||typeof X.binding!=="string"){if(!W.some((Y)=>JSON.stringify(Y)===JSON.stringify(X)))W.push(structuredClone(X));continue}let J=W.findIndex((G)=>b8(G)&&G.binding===X.binding);if(J===-1)W.push(structuredClone(X));else W[J]={...W[J],...X}}return W}function b8(Z){return Z!==null&&typeof Z==="object"&&!Array ...

214`)){let J=X.trim();if(J===""||J.startsWith("#"))continue;let G=J.indexOf("=");if(

215 `)}function vF(Z){if(typeof Z==="string")return Z;if(!Z||typeof Z!=="object")return"";let Q

217 SPDX-License-Identifier: Apache-2.0

218*/$={defined:UG,object:iF,plainObject:nF,fn:rF,bool:aF,buffer:sF,typedArray:oF,arrayBuffer:tF,string:eF,number:ZL,integer:QL,inRange:WL,inArray:XL,invalidParameterError:JL,nativeError:GL}});var BG=j((Zv,HG)=>{var VG=

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L211

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L212

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L217

220 SPDX-License-Identifier: Apache-2.0

221*/RI=process.env.npm_package_config_libvips||Y6.config.libvips,Cz=I9.default.coerce(RI).version,PI=["darwin-arm64","darwin-x64","freebsd-arm64","freebsd-x64","linux-arm","linux-arm64","linux-ppc64","linux-riscv64","linux-s390x"

223 SPDX-License-Identifier: Apache-2.0

224*/_0=mI(import.meta.url),{version:vz}=Y6,{runtimePlatformArch:lI,isUnsupportedNodeRuntime:xz,prebuiltPlatforms:dI,minimumLibvipsVersion:cI}=Z5,z6=lI(),C6=[];try{V0=_0(`../src/build/Release/sharp-${z6}-${vz}.node`

225`))}K0=V0});import pI from"node:util";import m7 from"node:stream";function rI(){let Z=this.constructor.call(),{debuglog:Q,queueListener:W,...X}=this.options;if(Z.options=structuredClone(X),Z.options.debuglog=Q,Z.options.queueListener=W,this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),Z.options.input.buffer=this.options.input.buffer,Z.emit("finish")});return Z}var iI,nI=(Z)=>{r6.queue.emit("change",Z)},r6=function(Z,Q){if(arguments.length===1&&!$.defined(Z))throw Error("Invalid input");if(!(this instanceof r6))return new r6(Z,Q);return m7.Duplex.call(this),this.options={topOf ...

227 SPDX-License-Identifier: Apache-2.0

228*/iI=pI.debuglog("sharp");Object.setPrototypeOf(r6.prototype,m7.Duplex.prototype);Object.setPrototypeOf(r6,m7.Duplex);Object.assign(r6.prototype,{clone:rI});p4=r6});function gz(Z){let Q=sI.filter((W)=>$.defined(Z[W])).map((W)=>[W,Z[W]]);return Q.length?Object.fromEntries(Q):void 0}function oI(Z,Q,W){let X={autoOrient:!1,failOn:"warning",limitInputPixels:268402689,limitInputChannels:5,ignoreIcc:!1,unlimited:!1,sequentialRead:!0};if($.string(Z))X.file=Z;else if($.buffer(Z)){if(Z.length===0)throw Error("Input Buffer is empty");X.buffer=Z}else if($.arrayBuffer(Z)){if(Z.byteLength===0)throw Error(" ...

230 SPDX-License-Identifier: Apache-2.0

231*/aI={left:"low",top:"low",low:"low",center:"centre",centre:"centre",right:"high",bottom:"high",high:"high"},sI=["failOn","limitInputPixels","limitInputChannels","unlimited","animated","autoOrient","density","ignoreIcc","page","pages","sequentialRead","jp2","openSlide","pdf","raw","svg","tiff","openSlideLevel","pdfBackground","tiffSubifd"]});function d7(Z){return Z.angle%360!==0||Z.rotationAngle!==0}function W5(Z){return Z.width!==-1||Z.height!==-1}function G2(Z,Q,W){if(W5(this.options))this.options.debuglog("ignoring previous resize options");if(this.options.widthPost!==-1)this.options.debugl ...

233 SPDX-License-Identifier: Apache-2.0

234*/mz={center:0,centre:0,north:1,east:2,south:3,west:4,northeast:5,southeast:6,southwest:7,northwest:8},lz={top:1,right:2,bottom:3,left:4,"right top"

236 SPDX-License-Identifier: Apache-2.0

237*/c7={clear:"clear",source:"source",over:"over",in:"in",out:"out",atop:"atop",dest:"dest","dest-over":"dest-over","dest-in":"dest-in","dest-out":"dest-out","dest-atop":"dest-atop",xor:"xor"

Long lines were clipped for display.

dist/compiler.jsView file

Lines 31-71javascript

31`,A?1+D:D);else if(T===Y){if(A)z.result+=`

32`}break}if(w)if(b(_))j=!0,z.result+=Z.repeat(`

33`,A?1+D:D);else if(j)j=!1,z.result+=Z.repeat(`

34`,D+1);else if(D===0){if(A)z.result+=" "}else z.result+=Z.repeat(`

35`,D);else z.result+=Z.repeat(`

36`,A?1+D:D);A=!0,x=!0,D=0;let R=z.position;while(!P(_)&&_!==0)_=z.input.charCodeAt(++z.position);M2(z,R,z.position,!1)}return!0}function b2(z,$){let{tag:w,anchor:T}=z,A=[],x=!1;if(z.firstTabInLine!==-1)return!1;if(z.anchor!==null)x2(z,z.anchor,A);let H=z.input.charCodeAt(z.position);while(H!==0){if(z.firstTabInLine!==-1)z.position=z.firstTabInLine,v(z,"tab characters must not be used in indentation");if(H!==45)break;let D=z.input.charCodeAt(z.position+1);if(!m(D))break;if(x=!0,z.position++,t(z,!0,-1)){if(z.lineIndent<=$){A.push(null),H=z.input.charCodeAt(z.position);continue}}let j=z.line;if(g2 ...

37`;if(z.charCodeAt(0)===65279)z=z.slice(1)}let w=new W2(z,$),T=z.indexOf("\x00");if(T!==-1)w.position=T,v(w,"null byte is not allowed in input");w.input+="\x00";while(w.input.charCodeAt(w.position)===32)w.lineIndent+=1,w.position+=1;while(w.position<w.length-1)R1(w);return w.documents}function n0(z,$,w){if($!==null&&typeof $==="object"&&typeof w>"u")w=$,$=null;let T=i0(z,w);if(typeof $!=="function")return T;for(let A=0,x=T.length;A<x;A+=1)$(T[A])}function P1(z,$){let w=i0(z,$);if(w.length===0)return;else if(w.length===1)return w[0];throw new X("expected a single document in the stream, but foun ...

38`,O);if(k===-1)N=H.slice(O),O=R;else N=H.slice(O,k+1),O=k+1;if(N.length&&N!==`

39`)_+=j;_+=N}return _}function G0(H,D){return`

40`+Z.repeat(" ",H.indent*D)}function m0(H,D){for(let j=0,O=H.implicitTypes.length;j<O;j+=1)if(H.implicitTypes[j].resolve(D))return!0;return!1}function M2(H){return H===Y||H===U}function c2(H){return H>=32&&H<=126||H>=161&&H<=55295&&H!==8232&&H!==8233||H>=57344&&H<=65533&&H!==J||H>=65536&&H<=1114111}function S2(H){return c2(H)&&H!==J&&H!==V&&H!==K}function J0(H,D,j){let O=S2(H),_=O&&!M2(H);return(j?O:O&&H!==E&&H!==l&&H!==X2&&H!==s2&&H!==L0)&&H!==B&&!(D===b&&!_)||S2(D)&&!M2(D)&&H===B||D===b&&_}function t(H){return c2(H)&&H!==J&&!M2(H)&&H!==P&&H!==u&&H!==b&&H!==E&&H!==l&&H!==X2&&H!==s2&&H!==L0&&H! ...

41`,R=O&&(H[H.length-2]===`

42`||H===`

43`)?"+":O?"":"-";return j+R+`

44`}function l0(H){return H[H.length-1]===`

45`?H.slice(0,-1):H}function C1(H,D){let j=/(\n+)([^\n]*)/g,O=function(){let k

46`);return k=k!==-1?k:H.length,j.lastIndex=k,g2(H.slice(0,k),D)}(),_=H[0]===`

47`||H[0]===" ",R,N;while(N=j.exec(H)){let k=N[1],S=N[2];R=

48`:"")+g2(S,D),_=R}return O}function g2(H,D){if(H===""||H[0]===

49`+H.slice(_,R),_=R+1;N=k}if(S+=`

50`,H.length-_>D&&N>_)S+=H.slice(_,N)+`

51`+H.slice(N+1);else S+=H.slice(_);return S.slice(1)}function R1(H){let D=

52`;return""}return A8.dump=x,A8}function OZ(){if(X4)return Q2;X4=1;let Z=wZ(),X=IZ();function W(Q,G){return function(){throw Error("Function yaml."+Q+" is removed in js-yaml 4. Use yaml."+G+" instead, which is now safe by default.")}}return Q2.Type=Y2(),Q2.Schema=z4(),Q2.FAILSAFE_SCHEMA=J4(),Q2.JSON_SCHEMA=V4(),Q2.CORE_SCHEMA=H4(),Q2.DEFAULT_SCHEMA=w8(),Q2.load=Z.load,Q2.loadAll=Z.loadAll,Q2.dump=X.dump,Q2.YAMLException=k0(),Q2.types={binary:F4(),float:q4(),map:G4(),null:U4(),pairs:D4(),set:L4(),timestamp:M4(),bool:Y4(),int:K4(),merge:B4(),omap:$4(),seq:Q4(),str:W4()},Q2.safeLoad=W("safeLoad"," ...

53Too many redirects:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/compiler.jsView on unpkg · L51

54 ${Q.join(`

55 `)}`);throw J.status=G.status,new N2(J)}else{let J=CZ(G,"location");if(!J){let

56`),U=G.map(({exportName:K})=>i4(K,W)).join(`

57`);return`// Generated by @jxsuite/compiler — do not edit manually

58// Deploy as a Cloudflare Worker, Node server, or Bun process.

59// Requires: npm install hono

61import { Hono } from 'hono'

62${J}

64const app = new Hono()

65${U}

67export default app

68`}function uZ(Z,X={}){let{baseUrl:W="/_jx/server",adapter:Q=null,mounts:G=[],connectors:J=[]}=X;if(Z.length===0&&G.length===0&&!Q)return null;let U=Z.map(({exportName:q,src:M})=>`import { ${q} } from '${M}'`).join(`

69`),K=fZ(G,J),V=Z.map(({exportName:q})=>i4(q,W)).join(`

70`),Y=Q==="cloudflare-workers"||Q==="cloudflare-pages"?`

71app.all('*', (c) => c.env.ASSETS.fetch(c.req.raw))

Long lines were clipped for display.

@jxsuite/compiler@1.1.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code