registry / @lambda-development/erp-core / 0.1.35

@lambda-development/erp-core@0.1.35

Frontend core of Lambda ERP — app shell, document/master pages, chat UI, reports, and extension registries.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 431 KB of source, external domains: lambda.dev, www.w3.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 4446-4486javascript

4446 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-gray-900", children: y.supplier_name }),

4447 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-gray-600", children: y.due_date }),

4448 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right font-medium", children: d(y.outstanding) }),

4449 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right", children: y.current ? d(y.current) : "" }),

4450 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right", children: y.b1_30 ? d(y.b1_30) : "" }),

4451 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right", children: y.b31_60 ? d(y.b31_60) : "" }),

4452 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right", children: y.b61_90 ? d(y.b61_90) : "" }),

4453 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right text-red-600", children: y.b90_plus ? d(y.b90_plus) : "" })

4454 ] }, L)) }),

4455 /* @__PURE__ */ e("tfoot", { className: "border-t-2 border-gray-300 bg-gray-50 font-semibold", children: /* @__PURE__ */ r("tr", { children: [

4456 /* @__PURE__ */ e("td", { className: "px-3 py-3", colSpan: 3, children: t("common.total") }),

4457 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: d(u.totals.outstanding) }),

4458 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: d(u.totals.current) }),

4459 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: d(u.totals.b1_30) }),

4460 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: d(u.totals.b31_60) }),

4461 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: d(u.totals.b61_90) }),

4462 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right text-red-600", children: d(u.totals.b90_plus) })

4463 ] }) })

4464 ] }) }) })

4465 ] });

4466}

4467const ia = '(function(){"use strict";function u(r,t){const e=Number(r??0)||0;return t==null?e:Number(e.toFixed(t))}const p={flt:u,sum(r,t){return r.reduce((e,a)=>typeof t=="function"?e+u(t(a)):typeof t=="string"?e+u(a[t]):e+u(a),0)},count(r){return r.length},sortBy(r,t,e="asc"){const n=(e===!0?"desc":e===!1?"asc":e)==="desc"?-1:1;return[...r].sort((s,i)=>{const c=s[t],o=i[t];return c==null&&o==null?0:c==null?1:o==null?-1:c<o?-1*n:c>o?1*n:0})},topN(r,t,e=10){return typeof t=="number"?r.slice(0,t):p.sortBy(r,t,"desc").slice(0,e)},group(r,t,e){if(typeof t=="function"){const s=new Map;for(const i ...

4468function as(t) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L4466

4469 let n;

4470 try {

4471 if (n = Tn && (self.URL || self.webkitURL).createObjectURL(Tn), !n) throw "";

4472 const a = new Worker(n, {

4473 name: t == null ? void 0 : t.name

4474 });

4475 return a.addEventListener("error", () => {

4476 (self.URL || self.webkitURL).revokeObjectURL(n);

4477 }), a;

4478 } catch {

4479 return new Worker(

4480 "data:text/javascript;charset=utf-8," + encodeURIComponent(ia),

4481 {

4482 name: t == null ? void 0 : t.name

4483 }

4484 );

4485 } finally {

4486 n && (self.URL || self.webkitURL).revokeObjectURL(n);

Long lines were clipped for display.

Lines 6703-6783javascript

6703 children: [

6704 /* @__PURE__ */ e("option", { value: "viewer", children: "viewer" }),

6705 /* @__PURE__ */ e("option", { value: "manager", children: "manager" }),

6706 /* @__PURE__ */ e("option", { value: "admin", children: "admin" })

Source & flagged code

4 flagged · loading source

dist/index.jsView file

6723patternName = generic_password severity = medium line = 6723 matchedText = const qs... = {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L6723

6743patternName = generic_password severity = medium line = 6743 matchedText = }, ai = ... = {

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L6743

6763patternName = generic_password severity = medium line = 6763 matchedText = }, ki = ... = {

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L6763

4466} L4467: const ia = '(function(){"use strict";function u(r,t){const e=Number(r??0)||0;return t==null?e:Number(e.toFixed(t))}const p={flt:u,sum(r,t){return r.reduce((e,a)=>typeof t=="functio... L4468: function as(t) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L4466

Findings

4 Medium4 Low

MediumSecret Patterndist/index.js

MediumNetwork

MediumSecret Patterndist/index.js

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings