Loading npm security reports…

@jxsuite/studio@1.1.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @jxsuite/studio / 1.1.0

@jxsuite/studio@1.1.0

Jx Studio — visual builder for Jx documents

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 218 file(s), 4.02 MB of source, external domains: api.github.com, example.com, fonts.googleapis.com, fonts.gstatic.com, github.com, json-schema.org, jxsuite.com, www.w3.org

Oversized source lightweight scan

dist/studio.js12.7 MB file, sampled 256 KB

FilesystemChildProcessShellHighEntropyStrings

dist/workers/ts.worker.js11.6 MB file, sampled 256 KB

FilesystemNetworkChildProcessShell

Source & flagged code

5 flagged

dist/iframe-entry.jsView file

Lines 2272-2350javascript

2272 state[key] = await resolveServerFunction(def2, state, key, base);

2273 }

2274 }

2275 }

2276 if (doc.$media) {

2277 state["$media"] = doc.$media;

2278 } else if (!state["$media"] && Object.keys(_rootMedia).length > 0) {

2279 state["$media"] = _rootMedia;

2280 }

2281 return state;

2282}

2283function hasSchemaKeywords(obj) {

2284 for (const k of Object.keys(obj)) {

2285 if (SCHEMA_KEYWORDS2.has(k)) {

2286 return true;

2287 }

2288 }

2289 return false;

2290}

2291function evaluateTemplate(str, state) {

2292 const $map = state?.$map;

2293 const fn = new Function("state", "$map", "item", "index", `return \`${str}\``);

2294 return fn(state, $map, $map?.item, $map?.index);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/iframe-entry.jsView on unpkg · L2292

2295}

2296var _moduleCache = new Map;

2297async function resolveFunction(def2, state, key, base) {

2298 if (def2.body && def2.$src) {

2299 throw new Error(`Jx: '${key}' declares both body and $src — these are mutually exclusive`);

2300 }

2301 if (!def2.body && !def2.$src) {

2302 const params = resolveParamNames(def2);

2303 const noop = new Function(...params, "");

2304 Object.defineProperty(noop, "name", {

2305 configurable: true,

2306 value: def2.name ?? key

2307 });

2308 return noop;

2309 }

2310 let fn;

2311 if (typeof def2.body === "string") {

2312 const params = resolveParamNames(def2);

2313 fn = new Function(...params, def2.body);

2314 Object.defineProperty(fn, "name", {

2315 configurable: true,

2316 value: def2.name ?? key

2317 });

2318 } else {

2319 const src = def2.$src;

2320 if (!src) {

2321 throw new Error(`Jx: '${key}' has neither body nor $src`);

2322 }

2323 const exportName = def2.$export ?? key;

2324 let mod;

2325 if (_moduleCache.has(src)) {

2326 mod = _moduleCache.get(src);

2327 } else {

2328 if (base) {

2329 const resolvedSrc = new URL(src, base).href;

2330 try {

2331 mod = await import(resolvedSrc);

2332 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/iframe-entry.jsView on unpkg · L2330

2333 mod = await import(src);

2334 }

2335 } else {

2336 mod = await import(src);

2337 }

2338 _moduleCache.set(src, mod);

2339 }

2340 const candidate = mod[exportName] ?? mod.default?.[exportName];

2341 if (typeof candidate !== "function") {

2342 throw new TypeError(`Jx: export "${exportName}" not found or not a function in "${src}"`);

2343 }

2344 fn = candidate;

2345 }

2346 const hasParams = (def2.parameters ?? def2.arguments ?? []).length > 0;

2347 let isComputed = false;

2348 if (!hasParams) {

2349 if (typeof def2.body === "string") {

2350 isComputed = /\breturn\b/.test(def2.body);

src/collab/collab-session.tsView file

Lines 20-60typescript

20 * evaluation defers until a collab session actually attaches.

21 */

23import { effect, onScopeDispose, toRaw } from "../reactivity";

24import { getPlatform } from "../platform";

25import { jsonClone } from

dist/studio.jsView file

•path = dist/studio.js kind = oversized_source_file sizeBytes = 13361559 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/studio.jsView on unpkg

src/platforms/cloud.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @jxsuite/studio@0.35.0 matchedIdentity = npm:QGp4c3VpdGUvc3R1ZGlv:0.35.0 similarity = 0.492 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/platforms/cloud.tsView on unpkg

Source & flagged code

5 flagged · loading source

dist/iframe-entry.jsView file

2330try { L2331: mod = await import(resolvedSrc); L2332: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/iframe-entry.jsView on unpkg · L2330

2292const $map = state?.$map; L2293: const fn = new Function("state", "$map", "item", "index", `return \`${str}\``); L2294: return fn(state, $map, $map?.item, $map?.index);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/iframe-entry.jsView on unpkg · L2292

src/collab/collab-session.tsView file

40package = @jxsuite/studio; repositoryIdentity = jx; dependency = @jxsuite/collab L40: import type { JxMutableNode } from "@jxsuite/schema/types"; L41: import type * as CollabNS from "@jxsuite/collab"; L42: import { collabState, registerCollabPath, unregisterCollabPath } from "./collab-state";

High

Findings

3 High4 Medium5 Low

HighCopied Package Dependency Bridgesrc/collab/collab-session.ts

HighOversized Source Filedist/studio.js

HighPrevious Version Dangerous Deltasrc/platforms/cloud.ts

MediumDynamic Requiredist/iframe-entry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/iframe-entry.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/iframe-entry.jsView file

Lines 2272-2350javascript

2272 state[key] = await resolveServerFunction(def2, state, key, base);

2273 }

2274 }

2275 }

2276 if (doc.$media) {

2277 state["$media"] = doc.$media;

2278 } else if (!state["$media"] && Object.keys(_rootMedia).length > 0) {

2279 state["$media"] = _rootMedia;

2280 }

2281 return state;

2282}

2283function hasSchemaKeywords(obj) {

2284 for (const k of Object.keys(obj)) {

2285 if (SCHEMA_KEYWORDS2.has(k)) {

2286 return true;

2287 }

2288 }

2289 return false;

2290}

2291function evaluateTemplate(str, state) {

2292 const $map = state?.$map;

2293 const fn = new Function("state", "$map", "item", "index", `return \`${str}\``);

2294 return fn(state, $map, $map?.item, $map?.index);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/iframe-entry.jsView on unpkg · L2292

2295}

2296var _moduleCache = new Map;

2297async function resolveFunction(def2, state, key, base) {

2298 if (def2.body && def2.$src) {

2299 throw new Error(`Jx: '${key}' declares both body and $src — these are mutually exclusive`);

2300 }

2301 if (!def2.body && !def2.$src) {

2302 const params = resolveParamNames(def2);

2303 const noop = new Function(...params, "");

2304 Object.defineProperty(noop, "name", {

2305 configurable: true,

2306 value: def2.name ?? key

2307 });

2308 return noop;

2309 }

2310 let fn;

2311 if (typeof def2.body === "string") {

2312 const params = resolveParamNames(def2);

2313 fn = new Function(...params, def2.body);

2314 Object.defineProperty(fn, "name", {

2315 configurable: true,

2316 value: def2.name ?? key

2317 });

2318 } else {

2319 const src = def2.$src;

2320 if (!src) {

2321 throw new Error(`Jx: '${key}' has neither body nor $src`);

2322 }

2323 const exportName = def2.$export ?? key;

2324 let mod;

2325 if (_moduleCache.has(src)) {

2326 mod = _moduleCache.get(src);

2327 } else {

2328 if (base) {

2329 const resolvedSrc = new URL(src, base).href;

2330 try {

2331 mod = await import(resolvedSrc);

2332 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/iframe-entry.jsView on unpkg · L2330

2333 mod = await import(src);

2334 }

2335 } else {

2336 mod = await import(src);

2337 }

2338 _moduleCache.set(src, mod);

2339 }

2340 const candidate = mod[exportName] ?? mod.default?.[exportName];

2341 if (typeof candidate !== "function") {

2342 throw new TypeError(`Jx: export "${exportName}" not found or not a function in "${src}"`);

2343 }

2344 fn = candidate;

2345 }

2346 const hasParams = (def2.parameters ?? def2.arguments ?? []).length > 0;

2347 let isComputed = false;

2348 if (!hasParams) {

2349 if (typeof def2.body === "string") {

2350 isComputed = /\breturn\b/.test(def2.body);

src/collab/collab-session.tsView file

Lines 20-60typescript

20 * evaluation defers until a collab session actually attaches.

21 */

23import { effect, onScopeDispose, toRaw } from "../reactivity";

24import { getPlatform } from "../platform";

25import { jsonClone } from

dist/studio.jsView file

•path = dist/studio.js kind = oversized_source_file sizeBytes = 13361559 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/studio.jsView on unpkg

src/platforms/cloud.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/platforms/cloud.tsView on unpkg