registry  /  @malloy-publisher/sdk  /  0.0.220

@malloy-publisher/sdk@0.0.220

⚠ Under review

Malloy Publisher SDK

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 135 file(s), 5.53 MB of source, external domains: account.blob.core.windows.net, docs.malloydata.dev, example.com, fb.me, fontawesome.com, github.com, html.spec.whatwg.org, join.slack.com, mui.com, pub.example.com, www.ibm.com, www.markdownguide.org, www.w3.org

Source & flagged code

3 flagged · loading source
dist/ServerProvider-C5fRNp_p.cjs.jsView file
1"use strict";const Q=require("react/jsx-runtime"),H=require("@tanstack/react-query"),h=require("axios"),A=require("react"),y=require("@mui/material"),u="http://localhost/api/v0".re...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/ServerProvider-C5fRNp_p.cjs.jsView on unpkg · L1
dist/index-fSSQGelK.es.jsView file
13676contains invisible/control Unicode U+202A (left-to-right embedding) /* @__PURE__ */ 'ᵁ<Õıʊҝջאٵ۞ޢߖࠏ੊ઑඡ๭༉༦჊ረዡᐕᒝᓃᓟᔥ\0\0\0\0\0\0ᕫᛍᦍᰒᷝ὾<U+2060>↰⊍⏀⏻⑂⠤⤒ⴈ⹈⿎〖㊺㘹㞬㣾㨨㩱㫠㬮ࠀEMabcfglmnoprstu\\bfms„‹•˜¦³¹ÈÏlig耻Æ䃆P耻&䀦cute耻Á䃁reve;䄂Āiyx}rc耻Â䃂;䐐r;쀀𝔄rave耻À䃀pha;䎑acr;䄀d;橓Āgp¡on;䄄f;쀀𝔸plyFunction;恡ing耻Å䃅Ācs¾Ãr;쀀𝒜ign;扔ilde耻Ã䃃ml耻
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index-fSSQGelK.es.jsView on unpkg · L13676
dist/index-BG4wWx4I.cjs.jsView file
•Trigger-reachable chain: manifest.main -> dist/index.cjs.js -> dist/index-BG4wWx4I.cjs.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-BG4wWx4I.cjs.jsView on unpkg

Findings

2 Critical4 Medium5 Low
CriticalTrojan Source Unicodedist/index-fSSQGelK.es.js
CriticalTrigger Reachable Dangerous Capabilitydist/index-BG4wWx4I.cjs.js
MediumDynamic Requiredist/ServerProvider-C5fRNp_p.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License