registry / @kodexa-ai/document-wasm-ts / 2026.2.0-29100876141

@kodexa-ai/document-wasm-ts@2026.2.0-29100876141

⚠ Under review

TypeScript WASM wrapper for high-performance Kodexa Document processing using Go backend

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 434 KB of source, external domains: cdnjs.cloudflare.com, sql.js.org

Source & flagged code

4 flagged

dist/kodexa-shared-worker.jsView file

Lines 1-29javascript

1var __getOwnPropNames = Object.getOwnPropertyNames;

2var __esm = (fn, res) => function __init() {

3 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

4};

5var __commonJS = (cb, mod) => function __require() {

6 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

7};

9// src/wasm/sqljs-core.ts

10function uint8ArrayToBase64(bytes) {

11 if (bytes.length < 32768) {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/kodexa-shared-worker.jsView on unpkg · L9

12 let binary2 = "";

13 for (let i = 0; i < bytes.length; i++) {

14 binary2 += String.fromCharCode(bytes[i]);

15 }

16 return btoa(binary2);

17 }

18 const chunkSize = 32768;

19 let binary = "";

20 for (let i = 0; i < bytes.length; i += chunkSize) {

21 const chunk = bytes.subarray(i, Math.min(i + chunkSize, bytes.length));

22 binary += String.fromCharCode.apply(null, Array.from(chunk));

23 }

24 return btoa(binary);

25}

26function processRowForJson(obj) {

27 const result = {};

28 for (const key in obj) {

29 const value = obj[key];

Lines 797-837javascript

797 body: null,

798 documentElement: null

799 };

800 self.document = documentShim;

801 console.log("[shared-worker] Event forwarding configured (simplified architecture)");

802 }

803 async function initializeSqlJs() {

804 const

dist/wasm/loader.jsView file

Lines 50-90javascript

50 if (wasmInstance) {

51 return wasmInstance;

52 }

53 try {

54 // CRITICAL: Initialize sql.js FIRST, before Go WASM

55 // This ensures the sql.js bridge functions are available on globalThis

56 // when Go WASM starts and tries to use them

57 if (!isSqlJsInitialized()) {

dist/kodexa.wasmView file

•path = dist/kodexa.wasm kind = wasm_module sizeBytes = 34021101 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/kodexa.wasmView on unpkg

Source & flagged code

4 flagged · loading source

dist/kodexa-shared-worker.jsView file

9// src/wasm/sqljs-core.ts L10: function uint8ArrayToBase64(bytes) { L11: if (bytes.length < 32768) { ... L796: createElement: () => null, L797: body: null, L798: documentElement: null ... L803: async function initializeSqlJs() { L804: const sqlJsUrl = "https://sql.js.org/dist/sql-wasm.js"; L805: const sqlWasmUrl = "https://sql.js.org/dist/sql-wasm.wasm"; ... L817: `; L818: const moduleFactory = eval(wrappedCode); L819: const mockModule = { exports: {} };

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/kodexa-shared-worker.jsView on unpkg · L9

817`; L818: const moduleFactory = eval(wrappedCode); L819: const mockModule = { exports: {} };

High

Eval

Package source references dynamic code evaluation.

dist/kodexa-shared-worker.jsView on unpkg · L817

dist/wasm/loader.jsView file

70// Node.js environment L71: const fs = require('fs'); L72: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/wasm/loader.jsView on unpkg · L70

dist/kodexa.wasmView file

•path = dist/kodexa.wasm kind = wasm_module sizeBytes = 34021101 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/kodexa.wasmView on unpkg

Findings

1 Critical3 High4 Medium5 Low

CriticalRemote Asset Decode Executedist/kodexa-shared-worker.js

HighChild Process

HighShell

HighEvaldist/kodexa-shared-worker.js

MediumDynamic Requiredist/wasm/loader.js

MediumNetwork

MediumShips Wasm Moduledist/kodexa.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/kodexa-shared-worker.jsView file

Lines 1-29javascript

1var __getOwnPropNames = Object.getOwnPropertyNames;

2var __esm = (fn, res) => function __init() {

3 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

4};

5var __commonJS = (cb, mod) => function __require() {

6 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

7};

9// src/wasm/sqljs-core.ts

10function uint8ArrayToBase64(bytes) {

11 if (bytes.length < 32768) {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/kodexa-shared-worker.jsView on unpkg · L9

12 let binary2 = "";

13 for (let i = 0; i < bytes.length; i++) {

14 binary2 += String.fromCharCode(bytes[i]);

15 }

16 return btoa(binary2);

17 }

18 const chunkSize = 32768;

19 let binary = "";

20 for (let i = 0; i < bytes.length; i += chunkSize) {

21 const chunk = bytes.subarray(i, Math.min(i + chunkSize, bytes.length));

22 binary += String.fromCharCode.apply(null, Array.from(chunk));

23 }

24 return btoa(binary);

25}

26function processRowForJson(obj) {

27 const result = {};

28 for (const key in obj) {

29 const value = obj[key];

Lines 797-837javascript

797 body: null,

798 documentElement: null

799 };

800 self.document = documentShim;

801 console.log("[shared-worker] Event forwarding configured (simplified architecture)");

802 }

803 async function initializeSqlJs() {

804 const

dist/wasm/loader.jsView file

Lines 50-90javascript

50 if (wasmInstance) {

51 return wasmInstance;

52 }

53 try {

54 // CRITICAL: Initialize sql.js FIRST, before Go WASM

55 // This ensures the sql.js bridge functions are available on globalThis

56 // when Go WASM starts and tries to use them

57 if (!isSqlJsInitialized()) {

dist/kodexa.wasmView file

•path = dist/kodexa.wasm kind = wasm_module sizeBytes = 34021101 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/kodexa.wasmView on unpkg