registry  /  @malloy-publisher/sdk  /  0.0.219

@malloy-publisher/sdk@0.0.219

⚠ Under review

Malloy Publisher SDK

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 119 file(s), 5.42 MB of source, external domains: account.blob.core.windows.net, docs.malloydata.dev, example.com, fb.me, fontawesome.com, github.com, html.spec.whatwg.org, join.slack.com, mui.com, pub.example.com, www.ibm.com, www.markdownguide.org, www.w3.org

Source & flagged code

3 flagged · loading source
dist/index.cjs.jsView file
1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("./index-CQMDeQ_C.cjs.js"),o=require("./ServerProvider-RXwIqb5f.cjs.js");exports.Ana...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1
dist/index-CQMDeQ_C.cjs.jsView file
198contains invisible/control Unicode U+200E (left-to-right mark) `));return typeof n=="string"?{type:n,contentType:n==="meridiem"?"letter":"digit",maxLength:void 0}:{type:n.sectionType,contentType:n.contentType,maxLength:n.maxLength}},YL=e=>{switch(e){case"ArrowUp":return 1;case"ArrowDown":return-1;case"
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index-CQMDeQ_C.cjs.jsView on unpkg · L198
•Trigger-reachable chain: manifest.main -> dist/index.cjs.js -> dist/index-CQMDeQ_C.cjs.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-CQMDeQ_C.cjs.jsView on unpkg

Findings

2 Critical4 Medium5 Low
CriticalTrojan Source Unicodedist/index-CQMDeQ_C.cjs.js
CriticalTrigger Reachable Dangerous Capabilitydist/index-CQMDeQ_C.cjs.js
MediumDynamic Requiredist/index.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License