registry / @mapvx/web-components-ssr / 1.5.4
@mapvx/web-components-ssr@1.5.4
⚠ Under reviewA modern, framework-agnostic web component built with Angular 20 that provides an interactive map and location discovery interface.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedProtestwareUrlStrings
NoLicense
Source & flagged code
2 flaggeddist/browser/chunk-VDwq1GVr.jsView file
2contains invisible/control Unicode U+FEFF (zero width no-break space)
`+e.extraStackTrace()),lu(J)}function Sg(J,re,pe,W){Cn(`Assertion failed: `+Ee(J)+`, at: `+[re?Ee(re):`unknown filename`,pe,W?Ee(W):`unknown function`])}function fu(){return ve.length}function Fg(J,re,pe){ke.set(ke.subarray(re,re+pe),J)}fun
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/browser/chunk-VDwq1GVr.jsView on unpkg · L2dist/browser/main.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/browser/main.jsView on unpkgFindings
1 Critical1 High3 Medium5 Low
CriticalTrojan Source Unicodedist/browser/chunk-VDwq1GVr.js
HighSemantic Analysis Limiteddist/browser/main.js
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @mapvx/web-components-ssr@1.5.4.
See all versions of @mapvx/web-components-ssr for other recorded verdicts.
- Review the evidence and your use of @mapvx/web-components-ssr@1.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.