registry / @lattice-php/lattice / 0.18.0

@lattice-php/lattice@0.18.0

Server-driven React components for Laravel and Inertia.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chain

HighEntropyStringsTelemetry

ManifestNo manifest risk signals triggered.

scanned 240 file(s), 439 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 117-157json

117 "./svg-sprite-client": {

118 "types": "./dist/svg-sprite-client.d.ts"

119 },

120 "./vite": {

121 "types": "./dist/vite.d.ts",

122 "import": "./dist/vite.js"

123 },

124 "./vite-client": {

125 "types": "./dist/vite-client.d.ts"

126 },

127 "./package.json": "./package.json"

128 },

129 "files": [

130 "dist",

131 "resources/icons"

132 ],

133 "publishConfig": {

134 "access": "public"

135 },

136 "scripts": {

137 "postinstall": "test ! -f vendor/bin/testbench || npm run boost:refresh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L137

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L137

138 "dev": "vite",

139 "build": "vite build",

140 "build:lib": "vite build --mode lib",

141 "build:lib:watch": "vite build --mode lib --watch",

142 "prepack": "npm run build:lib",

143 "test": "vitest run",

144 "test:browser": "vitest run --project browser",

145 "test:coverage": "vitest run --coverage",

146 "boost:refresh": "php vendor/bin/testbench boost:update --no-interaction",

147 "typecheck": "tsc --noEmit",

148 "type-coverage": "type-coverage --project tsconfig.json --at-least 99.5",

149 "check": "npm run lint && npm run format:check && npm run typecheck && npm run type-coverage && npm run test && npm run build:lib",

150 "check:package": "publint --strict && attw --pack . --profile esm-only --exclude-entrypoints ./css",

151 "fix": "npm run lint:fix && npm run format",

152 "docs:typecheck": "tsc --noEmit -p docs/tsconfig.json",

153 "docs:test": "vitest run --project jsdom docs",

154 "lint": "oxlint resources/js workbench/resources/js",

155 "lint:fix": "oxlint resources/js workbench/resources/js --fix",

156 "lint:github": "oxlint resources/js workbench/resources/js --format=github",

157 "format": "oxfmt --write \"resources/js/**/*.{ts,tsx}\" \"workbench/resources/js/**/*.{ts,tsx}\" \"docs/**/*.{ts,tsx,md,mdx}\"",

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = test ! -f vendor/bin/testbench || npm run boost:refresh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = test ! -f vendor/bin/testbench || npm run boost:refresh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

Source & flagged code

2 flagged

package.jsonView file

Lines 117-157json

117 "./svg-sprite-client": {

118 "types": "./dist/svg-sprite-client.d.ts"

119 },

120 "./vite": {

121 "types": "./dist/vite.d.ts",

122 "import": "./dist/vite.js"

123 },

124 "./vite-client": {

125 "types": "./dist/vite-client.d.ts"

126 },

127 "./package.json": "./package.json"

128 },

129 "files": [

130 "dist",

131 "resources/icons"

132 ],

133 "publishConfig": {

134 "access": "public"

135 },

136 "scripts": {

137 "postinstall": "test ! -f vendor/bin/testbench || npm run boost:refresh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L137

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L137

138 "dev": "vite",

139 "build": "vite build",

140 "build:lib": "vite build --mode lib",

141 "build:lib:watch": "vite build --mode lib --watch",

142 "prepack": "npm run build:lib",

143 "test": "vitest run",

144 "test:browser": "vitest run --project browser",

145 "test:coverage": "vitest run --coverage",

146 "boost:refresh": "php vendor/bin/testbench boost:update --no-interaction",

147 "typecheck": "tsc --noEmit",

148 "type-coverage": "type-coverage --project tsconfig.json --at-least 99.5",

149 "check": "npm run lint && npm run format:check && npm run typecheck && npm run type-coverage && npm run test && npm run build:lib",

150 "check:package": "publint --strict && attw --pack . --profile esm-only --exclude-entrypoints ./css",

151 "fix": "npm run lint:fix && npm run format",

152 "docs:typecheck": "tsc --noEmit -p docs/tsconfig.json",

153 "docs:test": "vitest run --project jsdom docs",

154 "lint": "oxlint resources/js workbench/resources/js",

155 "lint:fix": "oxlint resources/js workbench/resources/js --fix",

156 "lint:github": "oxlint resources/js workbench/resources/js --format=github",

157 "format": "oxfmt --write \"resources/js/**/*.{ts,tsx}\" \"workbench/resources/js/**/*.{ts,tsx}\" \"docs/**/*.{ts,tsx,md,mdx}\"",