registry / @marimo-team/frontend / 0.23.14

@marimo-team/frontend@0.23.14

⚠ Under review

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 29 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,665 file(s), 17.3 MB of source, external domains: 127.0.0.1, aistudio.google.com, anywidget.dev, api.example.com, api.iconify.design, api.inference.wandb.ai, api.openai.com, api.simplesvg.com, api.together.xyz, api.unisvg.com, aws.amazon.com, azure.microsoft.com, cdn.example.com, cdn.jsdelivr.net, chevrotain.io, cloud.google.com, console.anthropic.com, deepseek.com, developer.mozilla.org, docs.github.com, docs.marimo.io, docs.python.org, en.wikipedia.org, evil.com, evil.example.com, example.com, fb.me, git.new, github.com, json-schema.org, langium.org, links.marimo.app, lmstudio.ai, marimo.app, marimo.io, mistral.ai, models.github.ai, molab.marimo.io, mui.com, ollama.ai, opencode.ai, openrouter.ai, platform.openai.com, portal.azure.com, pypi.org, radix-ui.com, raw.githubusercontent.com, react-dnd.github.io, react.dev, reactflow.dev

Oversized source lightweight scan

dist/assets/Plot-BB9gg44K.js4.60 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringswww.w3.org

dist/assets/node-sql-parser-DfWMhh1q.js2.48 MB file, sampled 256 KB

ObfuscatedHighEntropyStringsMinified

Source & flagged code

19 flagged

package.jsonView file

Lines 149-189json

149 "streamdown": "^2.1.0",

150 "string-dedent": "^3.0.2",

151 "swiper": "^12.0.0",

152 "tailwind-merge": "^2.6.0",

153 "tailwindcss-animate": "^1.0.7",

154 "thememirror": "^2.0.1",

155 "timestring": "^7.0.0",

156 "typescript-memoize": "^1.1.1",

157 "use-acp": "0.2.6",

158 "use-resize-observer": "^9.1.0",

159 "vega-lite": "6.4.2",

160 "vega-loader": "^5.1.0",

161 "vega-parser": "^7.1.0",

162 "vega-tooltip": "^1.1.0",

163 "vscode-jsonrpc": "^8.2.1",

164 "vscode-languageserver-protocol": "^3.17.5",

165 "web-vitals": "^4.2.4",

166 "zod": "^4.3.6"

167 },

168 "scripts": {

169 "preinstall": "npx only-allow pnpm",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L169

170 "ci": "cross-env CI=true run-s lint typecheck test build",

171 "start": "vite",

172 "dev": "vite",

173 "build:watch": "vite build --watch --outDir ../marimo/_static",

174 "build": "cross-env vite build",

175 "test": "vitest",

176 "typecheck": "tsgo",

177 "format": "oxfmt --config ../.oxfmtrc.json",

178 "lint": "run-s lint:oxlint lint:stylelint",

179 "lint:oxlint": "oxlint --fix",

180 "lint:stylelint": "stylelint src/**/*.css --fix",

181 "preview": "vite preview",

182 "dev:quarto": "VITE_MARIMO_ISLANDS=true vite",

183 "dev:islands": "cross-env VITE_MARIMO_ISLANDS=true vite --config islands/vite.config.mts",

184 "build:islands": "cross-env VITE_MARIMO_ISLANDS=true vite --config islands/vite.config.mts build",

185 "preview:islands": "cross-env VITE_MARIMO_VERSION='0.4.6' VITE_MARIMO_ISLANDS=true vite --config islands/vite.config.mts build",

186 "storybook": "storybook dev -p 6006",

187 "build-storybook": "storybook build"

188 },

189 "peerDependencies": {

src/components/editor/connections/storage/__tests__/as-code.test.tsView file

Lines 1-32typescript

2import { describe, expect, it } from "vitest";

3import { prefixSecret } from "../../secrets";

4import { generateStorageCode } from "../as-code";

5import type { StorageConnection } from "../schemas";

dist/assets/dist-Dez1I5M9.jsView file

Lines 1-15javascript

1var ah,vs=[],Cn=[];(()=>{let e="lc,34,7n,7,7b,19,,,,2,,2,,,20,b,1c,l,g,,2t,7,2,6,2,2,,4,z,,u,r,2j,b,1m,9,9,,o,4,,9,,3,,5,17,3,3b,f,,w,1j,,,,4,8,4,,3,7,a,2,t,,1m,,,,2,4,8,,9,,a,2,q,,2,2,1l,,4,2,4,2,2,3,3,,u,2,3,,b,2,1l,,4,5,,2,4,,k,2,m,6,,,1m,,,2,,4,8,,7,3,a,2,u,,1n,,,,c,,9,,14,,3,,1l,3,5,3,,4,7,2,b,2,t,,1m,,2,,2,,3,,5,2,7,2,b,2,s,2,1l,2,,,2,4,8,,9,,a,2,t,,20,,4,,2,3,,,8,,29,,2,7,c,8,2q,,2,9,b,6,22,2,r,,,,,,1j,e,,5,,2,5,b,,10,9,,2u,4,,6,,2,2,2,p,2,4,3,g,4,d,,2,2,6,,f,,jj,3,qa,3,t,3,t,2,u,2,1s,2,,7,8,,2,b,9,,19,3,3b,2,y,,3a,3,4,2,9,,6,3,63,2,2,,1m,,,7,,,,,2,8,6,a,2,,1c,h,1r,4,1c,7,,,5,,14,9,c,2, ...

2`){[t,i]=ge(this,t,i);let r="";for(let n=0,o=0;n<=i&&o<this.text.length;o++){let l=this.text[o],a=n+l.length;n>t&&o&&(r+=s),t<a&&i>n&&(r+=l.slice(Math.max(0,t-n),i-n)),n=a+1}return r}flatten(t){for(let i of this.text)t.push(i)}scanIdentical(){return 0}static split(t,i){let s=[],r=-1;for(let n of t)s.push(n),r+=n.length+1,s.length==32&&(i.push(new Ht(s,r)),s=[],r=-1);return r>-1&&i.push(new Ht(s,r)),i}},gi=class Ne extends I{constructor(t,i){super(),this.children=t,this.length=i,this.lines=0;for(let s of t)this.lines+=s.lines}lineInner(t,i,s,r){for(let n=0;;n++){let o=this.children[n],l=r+o.len ...

3`){[t,i]=

dist/assets/react-vega-DJIihc-q.jsView file

3${l}`)}return u})(e,"",0)}function qu(e){let t=e||bn,n=[],r={};return n.add=i=>{let a=t(i);return r[a]||(r[a]=1,n.push(i)),n},n.remove=i=>{let a=t(i);if(r[a]){r[a]=0;let o=n.indexO... L4: `),i!==vt.text&&(kn(t,0),o=t.ownerDocument,l=Ai(n),a.forEach((s,u)=>{let c=Si(o,"tspan",nt);c.__data__=n,c.textContent=s,u&&(c.setAttribute("x",0),c.setAttribute("dy",l)),t.appendC... L5: `;break;case"r":e+="\r";break;case"t":e+=" ";break;case"b":e+="\b";break;case"f":e+="\f";break;case"v":e+="\v";break;default:Rs(r)?(i="01234567".indexOf(r),i!==0&&(a=!0),z<wt&&Rs(Z...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/react-vega-DJIihc-q.jsView on unpkg · L3

dist/assets/loro_wasm_bg-BFCm9sQd.jsView file

Lines 1-3javascript

1import{r as Ai}from"./chunk-LvLJmgfZ.js";let se,ae,ie,le,ge,ce,de,we,be,ue,pe,he,fe,me,ve,ye,xe,Se,Ce,Ae,Oe,Ie,Ne,Fe,De,Le,ke,Ee,Re,Te,Je,Ve,Ue,Pe,Be,Me,ze,je,We,He,qe,$e,Ke,Ge,Qe,Xe,Ye,Ze,et,tt,rt,_t,ot,nt,st,at,it,lt,gt,ct,dt,wt,bt,ut,pt,ht,ft,mt,vt,yt,xt,St,Ct,At,Ot,It,Nt,Ft,Dt,Lt,kt,Et,Rt,Tt,Jt,Vt,Ut,Pt,Bt,Mt,zt,jt,Wt,Ht,qt,$t,Kt,Gt,Qt,Xt,Yt,Zt,er,tr,rr,_r,or,nr,sr,ar,ir,lr,gr,cr,dr,wr,br,ur,pr,hr,fr,mr,vr,yr,xr,Sr,Cr,Ar,Or,Ir,Nr,Fr,Dr,Lr,kr,Er,Rr,Tr,Jr,Vr,Ur,Pr,Br,Mr,zr,jr,Wr,Hr,qr,$r,Kr,Gr,Qr,Xr,Yr,Zr,e_,t_,r_,__,o_,n_,s_,a_,i_,l_,g_,c_,d_,w_,b_,u_,p_,h_,f_,m_,v_,y_,x_,S_,C_,A_,O_,I_,N_, ...

2${_.stack}`:o}function n(_){let e=r.__wbindgen_export_4.get(_);return r.__externref_table_dealloc(_),e}function O(_,e){if(!(_ instanceof e))throw Error(`expected instance of ${e.name}`)}function m(_,e){let t=e(_.length*1,1)>>>0;return C().set(_,t/1),i=_.length,t}function v(_,e){return _>>>=0,C().subarray(_/1,_/1+e)}function f(_,e){_>>>=0;let t=b(),o=[];for(let s=_;s<_+4*e;s+=4)o.push(r.__wbindgen_export_4.get(t.getUint32(s,!0)));return r.__externref_drop_slice(_,e),o}so=function(){r.callPendingEvents()};function Ti(_){let e=m(_,r.__wbindgen_malloc),t=i,o=r.decodeFrontiers(e,t);if(o[2])throw n( ...

dist/assets/worker-Bp53hInb.jsView file

Lines 16-56javascript

16 }

17 } else {

18 newResult[${o}] = ${n}.value;

19 }

21 `):t.write(`

22 if (${n}.issues.length) {

23 payload.issues = payload.issues.concat(${n}.issues.map(iss

dist/assets/loro_wasm_bg-WKwciKJa.wasmView file

•path = dist/assets/loro_wasm_bg-WKwciKJa.wasm kind = wasm_module sizeBytes = 3263252 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/loro_wasm_bg-WKwciKJa.wasmView on unpkg

dist/export_demos/wasm-intro.pyView file

•path = dist/export_demos/wasm-intro.py kind = build_helper sizeBytes = 13544 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/export_demos/wasm-intro.pyView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/Plot-BB9gg44K.jsView file

•path = dist/assets/Plot-BB9gg44K.js kind = oversized_source_file sizeBytes = 4827160 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/Plot-BB9gg44K.jsView on unpkg

dist/assets/glide-data-editor-zlTMrHkt.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @marimo-team/frontend@0.23.13 matchedIdentity = npm:QG1hcmltby10ZWFtL2Zyb250ZW5k:0.23.13 similarity = 0.675 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/glide-data-editor-zlTMrHkt.jsView on unpkg

src/components/editor/connections/database/__tests__/as-code.test.tsView file

Lines 219-299typescript

219 };

220

221 const pysparkConnection: DatabaseConnection = {

222 type: "pyspark",

223 };

224

225 const pysparkConnSession: DatabaseConnection =

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.preinstall = npx only-allow pnpm

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/components/editor/connections/storage/__tests__/as-code.test.tsView file

12patternName = aws_access_key severity = critical line = 12 matchedText = access_k...LE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L12

12patternName = aws_access_key severity = critical line = 12 matchedText = access_k...LE",

Critical

Secret Pattern

AWS access key ID in src/components/editor/connections/storage/__tests__/as-code.test.ts

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L12

34patternName = aws_access_key severity = critical line = 34 matchedText = access_k...LE",

Critical

Secret Pattern

AWS access key ID in src/components/editor/connections/storage/__tests__/as-code.test.ts

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L34

dist/assets/dist-Dez1I5M9.jsView file

10`))};if((k.mac||k.android)&&u.from==o-1&&/^\. ?$/.test(s.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(u={from:l,to:a,insert:I.of([s.text.replace("."," ")])}),this.pendi... L11: -\x7F-\x9F\xAD\u061C\u200B\u200E\u200F\u2028\u2029\u202D\u202E\u2066\u2067\u2069\uFEFF\uFFF9-\uFFFC]`,Ar),mf={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"ca... L12: `,f),p=d<0?u.length:d;if(p>f&&s(u.slice(f,p),c),d<0)break;r(),f=d+1}l=h}}zr(t,i,(h,c,u)=>{a(h,""),a(c,u)},n,o),a(o,"")}var Bd=class{constructor(e,t,i){this.at=e,this.highlighters=t...

High

Child Process

Package source references child process execution.

dist/assets/dist-Dez1I5M9.jsView on unpkg · L10

dist/assets/react-vega-DJIihc-q.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/react-vega-DJIihc-q.jsView on unpkg · L3

dist/assets/loro_wasm_bg-BFCm9sQd.jsView file

1import{r as Ai}from"./chunk-LvLJmgfZ.js";let se,ae,ie,le,ge,ce,de,we,be,ue,pe,he,fe,me,ve,ye,xe,Se,Ce,Ae,Oe,Ie,Ne,Fe,De,Le,ke,Ee,Re,Te,Je,Ve,Ue,Pe,Be,Me,ze,je,We,He,qe,$e,Ke,Ge,Qe,... L2: ${_.stack}`:o}function n(_){let e=r.__wbindgen_export_4.get(_);return r.__externref_table_dealloc(_),e}function O(_,e){if(!(_ instanceof e))throw Error(`expected instance of ${e.na...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/loro_wasm_bg-BFCm9sQd.jsView on unpkg · L1

dist/assets/worker-Bp53hInb.jsView file

36L37: `)}t.write(`payload.value = newResult;`),t.write(`return payload;`);let s=t.compile();return(t,n)=>s(e,t,n)},a,o=we,s=!me.jitless,c=s&&Te.value,l=t.catchall,u;e._zod.parse=(d,f)=>{... L38: L39: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let n of e.seen.entries()){let r=n[1];if(t===n[0]){a(n);continue}if(e.external){let r=e.exter... L40: `).filter(function(t){return!!t.match(e)},this).map(function(e){e.indexOf(`(eval `)>-1&&(e=e.replace(/eval code/g,`eval`).replace(/(\(eval at [^()]*)|(,.*$)/g,``));var t=e.replace(... L41: `).filter(function(e){return!e.match(t)},this).map(function(e){if(e.indexOf(` > eval`)>-1&&(e=e.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,`:$1`)),e.indexOf(`@`)===... L42: print("[py] Starting marimo...")

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/worker-Bp53hInb.jsView on unpkg · L36

dist/assets/loro_wasm_bg-WKwciKJa.wasmView file

•path = dist/assets/loro_wasm_bg-WKwciKJa.wasm kind = wasm_module sizeBytes = 3263252 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/loro_wasm_bg-WKwciKJa.wasmView on unpkg

dist/export_demos/wasm-intro.pyView file

•path = dist/export_demos/wasm-intro.py kind = build_helper sizeBytes = 13544 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/export_demos/wasm-intro.pyView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/Plot-BB9gg44K.jsView file

•path = dist/assets/Plot-BB9gg44K.js kind = oversized_source_file sizeBytes = 4827160 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/Plot-BB9gg44K.jsView on unpkg

dist/assets/glide-data-editor-zlTMrHkt.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/glide-data-editor-zlTMrHkt.jsView on unpkg

src/components/editor/connections/database/__tests__/as-code.test.tsView file

239patternName = generic_password severity = medium line = 239 matchedText = password...rd",

Medium

Secret Pattern