registry / @learncard/lca-api-service / 1.2.16

@learncard/lca-api-service@1.2.16

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 104 file(s), 3.44 MB of source, external domains: cloud.learncard.com, docs.learncard.com, dogs.are.great, github.com, identitytoolkit.googleapis.com, petstore.swagger.io, reactjs.org, sso.scout.org, validator.swagger.io, www.example.com, www.googleapis.com, www.w3.org

Oversized source lightweight scan

dist/index.js68.9 MB file, sampled 256 KB

ChildProcessDynamicRequireHighEntropyStringsUrlStringsdogs.are.greatwww.example.com

Source & flagged code

9 flagged

src/swagger-ui/swagger-ui.jsView file

Lines 1-2javascript

1!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.SwaggerUICore=t():e.SwaggerUICore=t()}(this,(function(){return(()=>{var e={6024:(e,t,r)=>{"use strict";r.d(t,{Z:()=>E});var n=r(4250),s=r.n(n),a=r(1093),o=r.n(a),l=r(8493),i=r.n(l),c=r(3942),p=r.n(c),u=r(6689),d=r.n(u);const m=require("react-immutable-pure-component");var h=r.n(m),g=r(8082),f=r.n(g),y=r(580),v=r.n(y);class E extends(h()){constructor(){super(...arguments),o()(this,"getModelName",(e=>-1!==i()(e).call(e,"#/definiti ...

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swagger-ui/swagger-ui.jsView on unpkg · L1

2//# sourceMappingURL=swagger-ui.js.map

Long lines were clipped for display.

src/swagger-ui/swagger-ui-es-bundle-core.jsView file

Lines 1-3javascript

1/*! For license information please see swagger-ui-es-bundle-core.js.LICENSE.txt */

2import*as e from"react-immutable-pure-component";import*as t from"remarkable/linkify";import*as r from"dompurify";import*as a from"zenscroll";import*as n from"lodash/reduce";import*as l from

esbuildPlugins.cjsView file

Lines 1-10javascript

1const { sentryEsbuildPlugin } = require('@sentry/esbuild-plugin');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esbuildPlugins.cjsView on unpkg · L1

3module.exports = [

4 sentryEsbuildPlugin({

5 authToken: process.env.SENTRY_AUTH_TOKEN,

src/helpers/learnCard.helpers.tsView file

Lines 28-68typescript

28 (module as { default?: { getDidKitPlugin?: unknown } }).default?.getDidKitPlugin;

30 if (typeof factory !== 'function') {

31 throw new Error('DIDKit plugin factory not found in module exports');

src/didkit_wasm_bg.wasmView file

•path = src/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9275409 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 72238514 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

src/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...}));

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-bundle.js

src/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

src/swagger-ui/swagger-ui-es-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-es-bundle.js

src/swagger-ui/swagger-ui-es-bundle.jsView on unpkg · L2

Source & flagged code

9 flagged · loading source

src/swagger-ui/swagger-ui.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = !functio...}));

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swagger-ui/swagger-ui.jsView on unpkg · L1

src/swagger-ui/swagger-ui-es-bundle-core.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = import*a...lt};

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-es-bundle-core.js

src/swagger-ui/swagger-ui-es-bundle-core.jsView on unpkg · L2

1/*! For license information please see swagger-ui-es-bundle-core.js.LICENSE.txt */ L2: import*as e from"react-immutable-pure-component";import*as t from"remarkable/linkify";import*as r from"dompurify";import*as a from"zenscroll";import*as n from"lodash/reduce";import... L3: //# sourceMappingURL=swagger-ui-es-bundle-core.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/swagger-ui/swagger-ui-es-bundle-core.jsView on unpkg · L1

esbuildPlugins.cjsView file

1const { sentryEsbuildPlugin } = require('@sentry/esbuild-plugin'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esbuildPlugins.cjsView on unpkg · L1

src/helpers/learnCard.helpers.tsView file

48package = @learncard/lca-api-service; repositoryIdentity = learncard; dependency = @learncard/didkit-plugin-node L48: try { L49: const didkitModule = await import('@learncard/didkit-plugin-node'); L50: const getNativePlugin = resolveDidKitPluginFactory(didkitModule);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/helpers/learnCard.helpers.tsView on unpkg · L48

src/didkit_wasm_bg.wasmView file

•path = src/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9275409 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 72238514 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

src/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...}));

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-bundle.js

src/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

src/swagger-ui/swagger-ui-es-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-es-bundle.js

src/swagger-ui/swagger-ui-es-bundle.jsView on unpkg · L2

Findings

2 High10 Medium6 Low

HighCopied Package Dependency Bridgesrc/helpers/learnCard.helpers.ts

HighOversized Source Filedist/index.js

MediumSecret Patternsrc/swagger-ui/swagger-ui.js

MediumDynamic RequireesbuildPlugins.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Modulesrc/didkit_wasm_bg.wasm

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/swagger-ui/swagger-ui-es-bundle-core.js

MediumSecret Patternsrc/swagger-ui/swagger-ui-bundle.js

MediumSecret Patternsrc/swagger-ui/swagger-ui-es-bundle.js

LowScripts Present

LowEvalsrc/swagger-ui/swagger-ui-es-bundle-core.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

src/swagger-ui/swagger-ui.jsView file

Lines 1-2javascript

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swagger-ui/swagger-ui.jsView on unpkg · L1

2//# sourceMappingURL=swagger-ui.js.map

Long lines were clipped for display.

src/swagger-ui/swagger-ui-es-bundle-core.jsView file

Lines 1-3javascript

1/*! For license information please see swagger-ui-es-bundle-core.js.LICENSE.txt */

2import*as e from"react-immutable-pure-component";import*as t from"remarkable/linkify";import*as r from"dompurify";import*as a from"zenscroll";import*as n from"lodash/reduce";import*as l from

esbuildPlugins.cjsView file

Lines 1-10javascript

1const { sentryEsbuildPlugin } = require('@sentry/esbuild-plugin');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esbuildPlugins.cjsView on unpkg · L1

3module.exports = [

4 sentryEsbuildPlugin({

5 authToken: process.env.SENTRY_AUTH_TOKEN,

src/helpers/learnCard.helpers.tsView file

Lines 28-68typescript

28 (module as { default?: { getDidKitPlugin?: unknown } }).default?.getDidKitPlugin;

30 if (typeof factory !== 'function') {

31 throw new Error('DIDKit plugin factory not found in module exports');

src/didkit_wasm_bg.wasmView file

•path = src/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9275409 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 72238514 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

src/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...}));

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-bundle.js

src/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

src/swagger-ui/swagger-ui-es-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-es-bundle.js

src/swagger-ui/swagger-ui-es-bundle.jsView on unpkg · L2