registry / @lambda-development/erp-core / 0.1.48

@lambda-development/erp-core@0.1.48

Frontend core of Lambda ERP — app shell, document/master pages, chat UI, reports, and extension registries.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 448 KB of source, external domains: lambda.dev

Source & flagged code

4 flagged

dist/index.jsView file

Lines 4567-4607javascript

4567 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-gray-900", children: f.supplier_name }),

4568 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-gray-600", children: f.due_date }),

4569 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right font-medium", children: u(f.outstanding) }),

4570 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right", children: f.current ? u(f.current) : "" }),

4571 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right", children: f.b1_30 ? u(f.b1_30) : "" }),

4572 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right", children: f.b31_60 ? u(f.b31_60) : "" }),

4573 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right", children: f.b61_90 ? u(f.b61_90) : "" }),

4574 /* @__PURE__ */ e("td", { className: "px-3 py-2 text-right text-red-600", children: f.b90_plus ? u(f.b90_plus) : "" })

4575 ] }, I)) }),

4576 /* @__PURE__ */ e("tfoot", { className: "border-t-2 border-gray-300 bg-gray-50 font-semibold", children: /* @__PURE__ */ r("tr", { children: [

4577 /* @__PURE__ */ e("td", { className: "px-3 py-3", colSpan: 3, children: t("common.total") }),

4578 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: u(m.totals.outstanding) }),

4579 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: u(m.totals.current) }),

4580 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: u(m.totals.b1_30) }),

4581 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: u(m.totals.b31_60) }),

4582 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right", children: u(m.totals.b61_90) }),

4583 /* @__PURE__ */ e("td", { className: "px-3 py-3 text-right text-red-600", children: u(m.totals.b90_plus) })

4584 ] }) })

4585 ] }) }) })

4586 ] });

4587}

4588const oa = '(function(){"use strict";function u(r,t){const e=Number(r??0)||0;return t==null?e:Number(e.toFixed(t))}const p={flt:u,sum(r,t){return r.reduce((e,a)=>typeof t=="function"?e+u(t(a)):typeof t=="string"?e+u(a[t]):e+u(a),0)},count(r){return r.length},sortBy(r,t,e="asc"){const n=(e===!0?"desc":e===!1?"asc":e)==="desc"?-1:1;return[...r].sort((s,i)=>{const c=s[t],o=i[t];return c==null&&o==null?0:c==null?1:o==null?-1:c<o?-1*n:c>o?1*n:0})},topN(r,t,e=10){return typeof t=="number"?r.slice(0,t):p.sortBy(r,t,"desc").slice(0,e)},group(r,t,e){if(typeof t=="function"){const s=new Map;for(const i ...

4589function ls(t) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L4587

4590 let n;

4591 try {

4592 if (n = Tn && (self.URL || self.webkitURL).createObjectURL(Tn), !n) throw "";

4593 const a = new Worker(n, {

4594 name: t == null ? void 0 : t.name

4595 });

4596 return a.addEventListener("error", () => {

4597 (self.URL || self.webkitURL).revokeObjectURL(n);

4598 }), a;

4599 } catch {

4600 return new Worker(

4601 "data:text/javascript;charset=utf-8," + encodeURIComponent(oa),

4602 {

4603 name: t == null ? void 0 : t.name

4604 }

4605 );

4606 } finally {

4607 n && (self.URL || self.webkitURL).revokeObjectURL(n);

Long lines were clipped for display.

Lines 6824-6906javascript

6824 children: [

6825 /* @__PURE__ */ e("option", { value: "viewer", children: "viewer" }),

6826 /* @__PURE__ */ e("option", { value: "manager", children: "manager" }),

6827 /* @__PURE__ */ e("option", { value: "admin", children: "admin" })

Source & flagged code

4 flagged · loading source

dist/index.jsView file

6844patternName = generic_password severity = medium line = 6844 matchedText = const Us... = {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L6844

6865patternName = generic_password severity = medium line = 6865 matchedText = }, ci = ... = {

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L6865

6886patternName = generic_password severity = medium line = 6886 matchedText = }, Ti = ... = {

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L6886

4587} L4588: const oa = '(function(){"use strict";function u(r,t){const e=Number(r??0)||0;return t==null?e:Number(e.toFixed(t))}const p={flt:u,sum(r,t){return r.reduce((e,a)=>typeof t=="functio... L4589: function ls(t) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L4587

Findings

4 Medium4 Low

MediumSecret Patterndist/index.js

MediumNetwork

MediumSecret Patterndist/index.js

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings