registry / @learncard/lca-api-service / 1.2.18

@learncard/lca-api-service@1.2.18

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 104 file(s), 3.45 MB of source, external domains: cloud.learncard.com, docs.learncard.com, dogs.are.great, github.com, identitytoolkit.googleapis.com, petstore.swagger.io, reactjs.org, sso.scout.org, validator.swagger.io, www.example.com, www.googleapis.com, www.w3.org

Oversized source lightweight scan

dist/index.js109 MB file, sampled 256 KB

ChildProcessDynamicRequireHighEntropyStringsUrlStringsdogs.are.greatwww.example.com

Source & flagged code

9 flagged

src/swagger-ui/swagger-ui.jsView file

Lines 1-2javascript

1!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.SwaggerUICore=t():e.SwaggerUICore=t()}(this,(function(){return(()=>{var e={6024:(e,t,r)=>{"use strict";r.d(t,{Z:()=>E});var n=r(4250),s=r.n(n),a=r(1093),o=r.n(a),l=r(8493),i=r.n(l),c=r(3942),p=r.n(c),u=r(6689),d=r.n(u);const m=require("react-immutable-pure-component");var h=r.n(m),g=r(8082),f=r.n(g),y=r(580),v=r.n(y);class E extends(h()){constructor(){super(...arguments),o()(this,"getModelName",(e=>-1!==i()(e).call(e,"#/definiti ...

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swagger-ui/swagger-ui.jsView on unpkg · L1

2//# sourceMappingURL=swagger-ui.js.map

Long lines were clipped for display.

src/swagger-ui/swagger-ui-es-bundle-core.jsView file

Lines 1-3javascript

1/*! For license information please see swagger-ui-es-bundle-core.js.LICENSE.txt */

2import*as e from"react-immutable-pure-component";import*as t from"remarkable/linkify";import*as r from"dompurify";import*as a from"zenscroll";import*as n from"lodash/reduce";import*as l from

esbuildPlugins.cjsView file

Lines 1-21javascript

1const path = require('node:path');

2const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esbuildPlugins.cjsView on unpkg · L1

4const { sentryEsbuildPlugin } = require

src/helpers/learnCard.helpers.tsView file

Lines 47-87typescript

47 (module as { getDidKitPlugin?: unknown }).getDidKitPlugin ??

48 (module as { default?: { getDidKitPlugin?: unknown } }).default?.getDidKitPlugin;

50 if (typeof factory !== 'function') {

dist/didkit_wasm_bg.wasmView file

•path = dist/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9282765 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 114286285 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

src/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...}));

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-bundle.js

src/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

src/swagger-ui/swagger-ui-es-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-es-bundle.js

src/swagger-ui/swagger-ui-es-bundle.jsView on unpkg · L2

Source & flagged code

9 flagged · loading source

src/swagger-ui/swagger-ui.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = !functio...}));

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swagger-ui/swagger-ui.jsView on unpkg · L1

src/swagger-ui/swagger-ui-es-bundle-core.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = import*a...lt};

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-es-bundle-core.js

src/swagger-ui/swagger-ui-es-bundle-core.jsView on unpkg · L2

1/*! For license information please see swagger-ui-es-bundle-core.js.LICENSE.txt */ L2: import*as e from"react-immutable-pure-component";import*as t from"remarkable/linkify";import*as r from"dompurify";import*as a from"zenscroll";import*as n from"lodash/reduce";import... L3: //# sourceMappingURL=swagger-ui-es-bundle-core.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/swagger-ui/swagger-ui-es-bundle-core.jsView on unpkg · L1

esbuildPlugins.cjsView file

1const path = require('node:path'); L2: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esbuildPlugins.cjsView on unpkg · L1

src/helpers/learnCard.helpers.tsView file

67package = @learncard/lca-api-service; repositoryIdentity = learncard; dependency = @learncard/didkit-plugin-node L67: try { L68: const didkitModule = await import('@learncard/didkit-plugin-node'); L69: const getNativePlugin = resolveDidKitPluginFactory(didkitModule);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/helpers/learnCard.helpers.tsView on unpkg · L67

dist/didkit_wasm_bg.wasmView file

•path = dist/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9282765 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 114286285 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

src/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...}));

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-bundle.js

src/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

src/swagger-ui/swagger-ui-es-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-es-bundle.js

src/swagger-ui/swagger-ui-es-bundle.jsView on unpkg · L2

Findings

2 High10 Medium6 Low

HighCopied Package Dependency Bridgesrc/helpers/learnCard.helpers.ts

HighOversized Source Filedist/index.js

MediumSecret Patternsrc/swagger-ui/swagger-ui.js

MediumDynamic RequireesbuildPlugins.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/didkit_wasm_bg.wasm

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/swagger-ui/swagger-ui-es-bundle-core.js

MediumSecret Patternsrc/swagger-ui/swagger-ui-bundle.js

MediumSecret Patternsrc/swagger-ui/swagger-ui-es-bundle.js

LowScripts Present

LowEvalsrc/swagger-ui/swagger-ui-es-bundle-core.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

src/swagger-ui/swagger-ui.jsView file

Lines 1-2javascript

Medium

Secret Pattern

Package contains a possible secret pattern.

src/swagger-ui/swagger-ui.jsView on unpkg · L1

2//# sourceMappingURL=swagger-ui.js.map

Long lines were clipped for display.

src/swagger-ui/swagger-ui-es-bundle-core.jsView file

Lines 1-3javascript

1/*! For license information please see swagger-ui-es-bundle-core.js.LICENSE.txt */

2import*as e from"react-immutable-pure-component";import*as t from"remarkable/linkify";import*as r from"dompurify";import*as a from"zenscroll";import*as n from"lodash/reduce";import*as l from

esbuildPlugins.cjsView file

Lines 1-21javascript

1const path = require('node:path');

2const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esbuildPlugins.cjsView on unpkg · L1

4const { sentryEsbuildPlugin } = require

src/helpers/learnCard.helpers.tsView file

Lines 47-87typescript

47 (module as { getDidKitPlugin?: unknown }).getDidKitPlugin ??

48 (module as { default?: { getDidKitPlugin?: unknown } }).default?.getDidKitPlugin;

50 if (typeof factory !== 'function') {

dist/didkit_wasm_bg.wasmView file

•path = dist/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9282765 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 114286285 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

src/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...}));

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-bundle.js

src/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

src/swagger-ui/swagger-ui-es-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Hardcoded password in src/swagger-ui/swagger-ui-es-bundle.js

src/swagger-ui/swagger-ui-es-bundle.jsView on unpkg · L2