registry  /  @kubex/zinc  /  1.1.49

@kubex/zinc@1.1.49

A collection of web components for building web applications based off of @shoelace-style/Shoelace

Static Scan Results

scanned 49m ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 486 file(s), 5.49 MB of source, external domains: cdn.jsdelivr.net, cdn.lineicons.com, codepen.io, esm.sh, example.com, fonts.googleapis.com, github.com, seccdn.libravatar.org, tailwindcss.com, www.gravatar.com, www.markdownguide.org, www.w3.org, zinc.style

Source & flagged code

4 flagged · loading source
docs/pages/components/reveal.mdView file
326patternName = stripe_webhook_secret severity = high line = 326 matchedText = revealed...hij"
High
High Secret

Package contains a high-severity secret pattern.

docs/pages/components/reveal.mdView on unpkg · L326
326patternName = stripe_webhook_secret severity = high line = 326 matchedText = revealed...hij"
High
Secret Pattern

Stripe webhook signing secret in docs/pages/components/reveal.md

docs/pages/components/reveal.mdView on unpkg · L326
dist/chunks/zn.4YKYUIHS.jsView file
2`+d.message)}var a=new N;a.add(i),a.isGeoSVGGraphicRoot=!0;var o=t.width,n=t.height,s=t.viewBoxRect,l=this._boundingRect;if(!l){var f=void 0,u=void 0,p=void 0,c=void 0;if(o!=null?(... L3: `+o.message)}return za(t,a),g(a,function(o){var n=o.name;Ba(t,o),Ua(t,o);var s=this._specialAreas&&this._specialAreas[n];s&&o.transformTo(s.left,s.top,s.width,s.height)},this),a},r...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/zn.4YKYUIHS.jsView on unpkg · L2
dist/zn.min.jsView file
38`}};me.styles=E(vg),c([F(".dropdown")],me.prototype,"popup",2),c([F(".dropdown__trigger")],me.prototype,"trigger",2),c([F(".dropdown__panel")],me.prototype,"panel",2),c([p({type:Bo... L39: `);let g="";for(let v=0;v<b.length;v++){let x=b.charCodeAt(v);x<128?g+=String.fromCharCode(x):x<2048?(g+=String.fromCharCode(x>>6|192),g+=String.fromCharCode(x&63|128)):(g+=String.... L40: <link
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/zn.min.jsView on unpkg · L38

Findings

2 High4 Medium7 Low
HighHigh Secretdocs/pages/components/reveal.md
HighSecret Patterndocs/pages/components/reveal.md
MediumDynamic Requiredist/zn.min.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/chunks/zn.4YKYUIHS.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings