registry / @lessonkit/react / 1.7.4

@lessonkit/react@1.7.4

React components and hooks for building learning experiences with LessonKit.

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.41 MB of source, external domains: api.qrserver.com, example.com, lessonkit.readthedocs.io

Source & flagged code

1 flagged

dist/blocks-entry.cjsView file

Lines 89-129javascript

89});

90module.exports = __toCommonJS(blocks_entry_exports);

92// src/blocks/TrueFalse.tsx

93var import_accessibility = require("@lessonkit/accessibility");

94var import_react12 = __toESM(require("react"), 1);

96// src/assessment/AssessmentLessonGuard.tsx

97var import_react2 = require("react");

99// src/lessonContext.tsx

100var import_react = require("react");

101var LessonContext = (0, import_react.createContext)(void 0);

102function useEnclosingLessonId() {

103 return (0, import_react.useContext)(LessonContext);

104}

105

106// src/runtime/validateComponentId.ts

107var import_core = require("@lessonkit/core");

108function isDevEnvironment() {

109 const g = globalThis;

110 return typeof g.process !== "undefined" && g.process.env?.NODE_ENV !== "production";

111}

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/blocks-entry.cjsView on unpkg · L109

112function normalizeComponentId(id, path) {

113 if (path === "courseId") return (0, import_core.assertValidId)(id, "courseId");

114 if (path === "lessonId") return (0, import_core.assertValidId)(id, "lessonId");

115 if (path === "checkId") return (0, import_core.assertValidId)(id, "checkId");

116 if (path === "blockId") return (0, import_core.assertValidId)(id, "blockId");

117 return (0, import_core.assertValidId)(id, path);

118}

119

120// src/assessment/AssessmentLessonGuard.tsx

121var import_jsx_runtime = require("react/jsx-runtime");

122var warnedAssessmentOutsideLesson = false;

123function AssessmentLessonGuard(props) {

124 const enclosingLessonId = useEnclosingLessonId();

125 const missingLesson = enclosingLessonId === void 0;

126 (0, import_react2.useEffect)(() => {

127 if (!missingLesson || isDevEnvironment()) return;

128 if (!warnedAssessmentOutsideLesson) {

129 warnedAssessmentOutsideLesson = true;

Source & flagged code

1 flagged · loading source

dist/blocks-entry.cjsView file

109const g = globalThis; L110: return typeof g.process !== "undefined" && g.process.env?.NODE_ENV !== "production"; L111: } ... L154: showSolutions: opts.showSolutions, L155: getXAPIData: opts.getXAPIData, L156: ...opts.getCurrentState ? { getCurrentState: opts.getCurrentState } : {}, ... L3206: try { L3207: const base = typeof window !== "undefined" ? window.location.href : "https://example.com/"; L3208: const url = new URL(trimmed, base); ... L7894: for (let i = 0; i < seed.length; i += 1) { L7895: hash ^= seed.charCodeAt(i); L7896: hash = Math.imul(hash, 16777619);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/blocks-entry.cjsView on unpkg · L109

Findings

1 High2 Medium4 Low

HighCloud Metadata Accessdist/blocks-entry.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/blocks-entry.cjsView file

Lines 89-129javascript

89});

90module.exports = __toCommonJS(blocks_entry_exports);

92// src/blocks/TrueFalse.tsx

93var import_accessibility = require("@lessonkit/accessibility");

94var import_react12 = __toESM(require("react"), 1);

96// src/assessment/AssessmentLessonGuard.tsx

97var import_react2 = require("react");

99// src/lessonContext.tsx

100var import_react = require("react");

101var LessonContext = (0, import_react.createContext)(void 0);

102function useEnclosingLessonId() {

103 return (0, import_react.useContext)(LessonContext);

104}

105

106// src/runtime/validateComponentId.ts

107var import_core = require("@lessonkit/core");

108function isDevEnvironment() {

109 const g = globalThis;

110 return typeof g.process !== "undefined" && g.process.env?.NODE_ENV !== "production";

111}

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/blocks-entry.cjsView on unpkg · L109

112function normalizeComponentId(id, path) {

113 if (path === "courseId") return (0, import_core.assertValidId)(id, "courseId");

114 if (path === "lessonId") return (0, import_core.assertValidId)(id, "lessonId");

115 if (path === "checkId") return (0, import_core.assertValidId)(id, "checkId");

116 if (path === "blockId") return (0, import_core.assertValidId)(id, "blockId");

117 return (0, import_core.assertValidId)(id, path);

118}

119

120// src/assessment/AssessmentLessonGuard.tsx

121var import_jsx_runtime = require("react/jsx-runtime");

122var warnedAssessmentOutsideLesson = false;

123function AssessmentLessonGuard(props) {

124 const enclosingLessonId = useEnclosingLessonId();

125 const missingLesson = enclosingLessonId === void 0;

126 (0, import_react2.useEffect)(() => {

127 if (!missingLesson || isDevEnvironment()) return;

128 if (!warnedAssessmentOutsideLesson) {

129 warnedAssessmentOutsideLesson = true;