Loading npm security reports…

@kubex/zinc@1.1.33: Suspicious npm security report (Warn) | LPM Firewall

registry / @kubex/zinc / 1.1.33

@kubex/zinc@1.1.33

A collection of web components for building web applications based off of @shoelace-style/Shoelace

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 479 file(s), 5.42 MB of source, external domains: cdn.jsdelivr.net, cdn.lineicons.com, codepen.io, esm.sh, example.com, fonts.googleapis.com, github.com, seccdn.libravatar.org, tailwindcss.com, www.gravatar.com, www.markdownguide.org, www.w3.org, zinc.style

Source & flagged code

5 flagged

docs/pages/components/reveal.mdView file

Lines 306-346markdown

306 <strong>Secret Key</strong>

307 <zn-chip size="small" type="warning">Sensitive</zn-chip>

308 </div>

309 <zn-reveal duration="5000"

310 initial="sk_live_••••••••••••••••••••"

311 revealed="sk_live_xyz7890abcdef1234"

312 style="font-family: monospace; padding: 0.75rem; background: var(--zn-color-neutral-100); border-radius: 4px; display: block;">

313 </zn-reveal>

314 <div style="margin-top: 0.5rem; font-size: 0.75rem; color: var(--zn-color-neutral-600);">

315 Click to reveal for 5 seconds

316 </div>

317 </div>

318

319 <div>

320 <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 0.5rem;">

321 <strong>Webhook Secret</strong>

322 <zn-chip size="small" type="info">Optional</zn-chip>

323 </div>

324 <zn-reveal duration="5000"

325 initial="whsec_••••••••••••••••••••"

326 revealed="whsec_1234567890abcdefghij"

High

High Secret

Package contains a high-severity secret pattern.

docs/pages/components/reveal.mdView on unpkg · L326

High

Secret Pattern

Stripe webhook signing secret in docs/pages/components/reveal.md

docs/pages/components/reveal.mdView on unpkg · L326

327 style="font-family: monospace; padding: 0.75rem; background: var(--zn-color-neutral-100); border-radius: 4px; display: block;">

328 </zn-reveal>

329 <div style="margin-top: 0.5rem; font-size: 0.75rem; color: var(--zn-color-neutral-600);">

330 Click to reveal for 5 seconds

331 </div>

332 </div>

333 </div>

334</div>

335```

336

337### User Profile Example

338

339Show masked personal information that can be revealed on demand.

340

341```html:preview

342<div style="max-width: 500px; border: 1px solid var(--zn-color-neutral-200); border-radius: 8px; padding: 1.5rem;">

343 <h3 style="margin: 0 0 1rem 0;">Personal Information</h3>

344

345 <div style="display: grid; gap: 1rem;">

346 <div style="display: grid; grid-template-columns: 140px 1fr; gap: 1rem; align-items: center;">

dist/chunks/zn.4YKYUIHS.jsView file

Lines 1-4javascript

1import{$a as an,$c as aa,Ac as Ke,Ae as zn,B as Fo,Bc as vn,Be,Cb as Kt,Cc as Ie,Ce as Qe,D as Yo,Da as qi,Db as qt,De as Bn,E as Ho,Ea as Gr,Eb as

dist/zn.min.jsView file

38`}};me.styles=T(fg),c([V(".dropdown")],me.prototype,"popup",2),c([V(".dropdown__trigger")],me.prototype,"trigger",2),c([V(".dropdown__panel")],me.prototype,"panel",2),c([p({type:Bo... L39: `);let b="";for(let v=0;v<g.length;v++){let x=g.charCodeAt(v);x<128?b+=String.fromCharCode(x):x<2048?(b+=String.fromCharCode(x>>6|192),b+=String.fromCharCode(x&63|128)):(b+=String.... L40: <link

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/zn.min.jsView on unpkg · L38

scripts/build.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kubex/zinc@1.1.32 matchedIdentity = npm:QGt1YmV4L3ppbmM:1.1.32 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/build.jsView on unpkg

Source & flagged code

5 flagged · loading source

Source & flagged code

5 flagged

docs/pages/components/reveal.mdView file

Lines 306-346markdown

306 <strong>Secret Key</strong>

307 <zn-chip size="small" type="warning">Sensitive</zn-chip>

308 </div>

309 <zn-reveal duration="5000"

310 initial="sk_live_••••••••••••••••••••"

311 revealed="sk_live_xyz7890abcdef1234"

312 style="font-family: monospace; padding: 0.75rem; background: var(--zn-color-neutral-100); border-radius: 4px; display: block;">

313 </zn-reveal>

314 <div style="margin-top: 0.5rem; font-size: 0.75rem; color: var(--zn-color-neutral-600);">

315 Click to reveal for 5 seconds

316 </div>

317 </div>

318

319 <div>

320 <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 0.5rem;">

321 <strong>Webhook Secret</strong>

322 <zn-chip size="small" type="info">Optional</zn-chip>

323 </div>

324 <zn-reveal duration="5000"

325 initial="whsec_••••••••••••••••••••"

326 revealed="whsec_1234567890abcdefghij"

High

High Secret

Package contains a high-severity secret pattern.

docs/pages/components/reveal.mdView on unpkg · L326

High

Secret Pattern

Stripe webhook signing secret in docs/pages/components/reveal.md

docs/pages/components/reveal.mdView on unpkg · L326

327 style="font-family: monospace; padding: 0.75rem; background: var(--zn-color-neutral-100); border-radius: 4px; display: block;">

328 </zn-reveal>

329 <div style="margin-top: 0.5rem; font-size: 0.75rem; color: var(--zn-color-neutral-600);">

330 Click to reveal for 5 seconds

331 </div>

332 </div>

333 </div>

334</div>

335```

336

337### User Profile Example

338

339Show masked personal information that can be revealed on demand.

340

341```html:preview

342<div style="max-width: 500px; border: 1px solid var(--zn-color-neutral-200); border-radius: 8px; padding: 1.5rem;">

343 <h3 style="margin: 0 0 1rem 0;">Personal Information</h3>

344

345 <div style="display: grid; gap: 1rem;">

346 <div style="display: grid; grid-template-columns: 140px 1fr; gap: 1rem; align-items: center;">

dist/chunks/zn.4YKYUIHS.jsView file

Lines 1-4javascript

1import{$a as an,$c as aa,Ac as Ke,Ae as zn,B as Fo,Bc as vn,Be,Cb as Kt,Cc as Ie,Ce as Qe,D as Yo,Da as qi,Db as qt,De as Bn,E as Ho,Ea as Gr,Eb as

dist/zn.min.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/zn.min.jsView on unpkg · L38

scripts/build.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/build.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code