registry / @malloy-publisher/sdk / 0.0.218

@malloy-publisher/sdk@0.0.218

⚠ Under review

Malloy Publisher SDK

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 119 file(s), 5.42 MB of source, external domains: account.blob.core.windows.net, docs.malloydata.dev, example.com, fb.me, fontawesome.com, github.com, html.spec.whatwg.org, join.slack.com, mui.com, pub.example.com, www.ibm.com, www.markdownguide.org, www.w3.org

Source & flagged code

3 flagged

dist/core-XPfPHme9.cjs.jsView file

Lines 1-21javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const me=require("./engine-oniguruma-BkproSVE.cjs.js"),P=require("./index-DrGwF6d1.cjs.js");let q=class extends Error{constructor(e){super(e),this.name="ShikiError"}},$e=!1,In=!1;function zr(t=!0,e=!1){$e=t,In=e}function B(t,e=3){if($e&&!(typeof $e=="number"&&e>$e)){if(In)throw new Error(`[SHIKI DEPRECATE]: ${t}`);console.trace(`[SHIKI DEPRECATE]: ${t}`)}}function Vr(t){return Tt(t)}function Tt(t){return Array.isArray(t)?Kr(t):t instanceof RegExp?t:typeof t=="object"?Qr(t):t}function Kr(t){let e=[];for(let n=0,r=t. ...

2`)}findNextMatchSync(t,e,n){const r=this.scanner.findNextMatchSync(t,e,n);return r?{ruleId:this.rules[r.index],captureIndices:r.captureIndices}:null}},it=class{constructor(t,e){this.languageId=t,this.tokenType=e}},_s=class wt{_defaultAttributes;_embeddedLanguagesMatcher;constructor(e,n){this._defaultAttributes=new it(e,8),this._embeddedLanguagesMatcher=new ys(Object.entries(n||{}))}getDefaultAttributes(){return this._defaultAttributes}getBasicScopeAttributes(e){return e===null?wt._NULL_SCOPE_METADATA:this._getBasicScopeAttributes.get(e)}static _NULL_SCOPE_METADATA=new it(0,0);_getBasicScopeAtt ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core-XPfPHme9.cjs.jsView on unpkg · L1

3`;const a=this.createOnigString(t),i=a.content.length,o=new xs(n,t,this._tokenTypeMatchers,this.balancedBracketSelectors),c=Un(this,a,s,0,e,o,!0,r);return Mn(a),{lineLength:i,lineTokens:o,ruleStack:c.stack,stoppedEarly:c.stoppedEarly}}};function nn(t,e){return t=Vr(t),t.repository

4\f\r &/=>`.split(""),`

5\f\r "&'/=>\``.split("")],[`\0

6\f\r "&'/<=>`.split(""),`\0

7\f\r "&'/<=>\``.split("")]],unquoted:[[`

8\f\r &>`.split(""),`\0

9\f\r "&'<=>\``.split("")],[`\0

10\f\r "&'<=>\``.split(""),`\0

11\f\r "&'<=>\``.split("")]],single:[["&'".split(""),"\"&'`".split("")],["\0&'".split(""),"\0\"&'`".split("")]],double:[['"&'.split(""),"\"&'`".split("")],['\0"&'.split(""),"\0\"&'`".split("")]]};function ba(t,e,n,r){const s=r.schema,a=s.space==="svg"?!1:r.settings.omitOptionalTags;let i=s.space==="svg"?r.settings.closeEmptyElements:r.settings.voids.includes(t.tagName.toLowerCase());const o=[];let c;s.space==="html"&&t.tagName==="svg"&&(r.schema=P.svg);const l=wa(r,t.properties),u=r.all(s.space==="html"&&t.tagName==="template"?t.content:t);return r.schema=s,u&&(i=!1),(l||!a||!ga(t,e,n))&&(o.push ...

12\\(?: \d+

13 | c[A-Za-z]

14 | [gk]<[^>]+>

15 | [pPu]\{[^\}]+\}

16 | u[A-Fa-f\d]{4}

17 | x[A-Fa-f\d]{2}

18 )

19| \((?: \? (?: [:=!>]

20 | <(?:[=!]|[^>]+>)

21 | [A-Za-z\-]+:

Long lines were clipped for display.

dist/index-DYCNcUfd.es.jsView file

13802contains invisible/control Unicode U+202A (left-to-right embedding) /* @__PURE__ */ 'ᵁ<Õıʊҝջאٵ۞ޢߖࠏ੊ઑඡ๭༉༦჊ረዡᐕᒝᓃᓟᔥ\0\0\0\0\0\0ᕫᛍᦍᰒᷝ὾<U+2060>↰⊍⏀⏻⑂⠤⤒ⴈ⹈⿎〖㊺㘹㞬㣾㨨㩱㫠㬮ࠀEMabcfglmnoprstu\\bfms¦³¹ÈÏlig耻Æ䃆P耻&䀦cute耻Á䃁reve;䄂Āiyx}rc耻Â䃂;䐐r;쀀𝔄rave耻À䃀pha;䎑acr;䄀d;橓Āgp¡on;䄄f;쀀𝔸plyFunction;恡ing耻Å䃅Ācs¾Ãr;쀀𝒜ign;扔ilde耻Ã䃃ml耻

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index-DYCNcUfd.es.jsView on unpkg · L13802

dist/index-DrGwF6d1.cjs.jsView file

•Trigger-reachable chain: manifest.main -> dist/index.cjs.js -> dist/index-DrGwF6d1.cjs.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-DrGwF6d1.cjs.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/core-XPfPHme9.cjs.jsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const me=require("./engine-oniguruma-BkproSVE.cjs.js"),P=require("./index-DrGwF6d1.cjs.js");let q=cl... L2: `)}findNextMatchSync(t,e,n){const r=this.scanner.findNextMatchSync(t,e,n);return r?{ruleId:this.rules[r.index],captureIndices:r.captureIndices}:null}},it=class{constructor(t,e){thi...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core-XPfPHme9.cjs.jsView on unpkg · L1

dist/index-DYCNcUfd.es.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index-DYCNcUfd.es.jsView on unpkg · L13802

dist/index-DrGwF6d1.cjs.jsView file

•Trigger-reachable chain: manifest.main -> dist/index.cjs.js -> dist/index-DrGwF6d1.cjs.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-DrGwF6d1.cjs.jsView on unpkg

Findings

2 Critical4 Medium5 Low

CriticalTrojan Source Unicodedist/index-DYCNcUfd.es.js

CriticalTrigger Reachable Dangerous Capabilitydist/index-DrGwF6d1.cjs.js

MediumDynamic Requiredist/core-XPfPHme9.cjs.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/core-XPfPHme9.cjs.jsView file

Lines 1-21javascript

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core-XPfPHme9.cjs.jsView on unpkg · L1

4\f\r &/=>`.split(""),`

5\f\r "&'/=>\``.split("")],[`\0

6\f\r "&'/<=>`.split(""),`\0

7\f\r "&'/<=>\``.split("")]],unquoted:[[`

8\f\r &>`.split(""),`\0

9\f\r "&'<=>\``.split("")],[`\0

10\f\r "&'<=>\``.split(""),`\0

12\\(?: \d+

13 | c[A-Za-z]

14 | [gk]<[^>]+>

15 | [pPu]\{[^\}]+\}

16 | u[A-Fa-f\d]{4}

17 | x[A-Fa-f\d]{2}

18 )

19| \((?: \? (?: [:=!>]

20 | <(?:[=!]|[^>]+>)

21 | [A-Za-z\-]+:

Long lines were clipped for display.

dist/index-DYCNcUfd.es.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index-DYCNcUfd.es.jsView on unpkg · L13802

dist/index-DrGwF6d1.cjs.jsView file

•Trigger-reachable chain: manifest.main -> dist/index.cjs.js -> dist/index-DrGwF6d1.cjs.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-DrGwF6d1.cjs.jsView on unpkg