registry / @marimo-team/frontend / 0.23.14

@marimo-team/frontend@0.23.14

⚠ Under review

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 29 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,665 file(s), 17.3 MB of source, external domains: 127.0.0.1, aistudio.google.com, anywidget.dev, api.example.com, api.iconify.design, api.inference.wandb.ai, api.openai.com, api.simplesvg.com, api.together.xyz, api.unisvg.com, aws.amazon.com, azure.microsoft.com, cdn.example.com, cdn.jsdelivr.net, chevrotain.io, cloud.google.com, console.anthropic.com, deepseek.com, developer.mozilla.org, docs.github.com, docs.marimo.io, docs.python.org, en.wikipedia.org, evil.com, evil.example.com, example.com, fb.me, git.new, github.com, json-schema.org, langium.org, links.marimo.app, lmstudio.ai, marimo.app, marimo.io, mistral.ai, models.github.ai, molab.marimo.io, mui.com, ollama.ai, opencode.ai, openrouter.ai, platform.openai.com, portal.azure.com, pypi.org, radix-ui.com, raw.githubusercontent.com, react-dnd.github.io, react.dev, reactflow.dev

Oversized source lightweight scan

dist/assets/Plot-BB9gg44K.js4.60 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringswww.w3.org

dist/assets/node-sql-parser-DfWMhh1q.js2.48 MB file, sampled 256 KB

ObfuscatedHighEntropyStringsMinified

Source & flagged code

19 flagged

package.jsonView file

Lines 149-189json

149 "streamdown": "^2.1.0",

150 "string-dedent": "^3.0.2",

151 "swiper": "^12.0.0",

152 "tailwind-merge": "^2.6.0",

153 "tailwindcss-animate": "^1.0.7",

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.preinstall = npx only-allow pnpm

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/components/editor/connections/storage/__tests__/as-code.test.tsView file

12patternName = aws_access_key severity = critical line = 12 matchedText = access_k...LE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L12

12patternName = aws_access_key severity = critical line = 12 matchedText = access_k...LE",

Critical

Secret Pattern

AWS access key ID in src/components/editor/connections/storage/__tests__/as-code.test.ts

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L12

34patternName = aws_access_key severity = critical line = 34 matchedText = access_k...LE",

Critical

Secret Pattern

AWS access key ID in src/components/editor/connections/storage/__tests__/as-code.test.ts

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L34

dist/assets/dist-Dez1I5M9.jsView file

10`))};if((k.mac||k.android)&&u.from==o-1&&/^\. ?$/.test(s.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(u={from:l,to:a,insert:I.of([s.text.replace("."," ")])}),this.pendi... L11: -\x7F-\x9F\xAD\u061C\u200B\u200E\u200F\u2028\u2029\u202D\u202E\u2066\u2067\u2069\uFEFF\uFFF9-\uFFFC]`,Ar),mf={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"ca... L12: `,f),p=d<0?u.length:d;if(p>f&&s(u.slice(f,p),c),d<0)break;r(),f=d+1}l=h}}zr(t,i,(h,c,u)=>{a(h,""),a(c,u)},n,o),a(o,"")}var Bd=class{constructor(e,t,i){this.at=e,this.highlighters=t...

High

Child Process

Package source references child process execution.

dist/assets/dist-Dez1I5M9.jsView on unpkg · L10

dist/assets/react-vega-DJIihc-q.jsView file

3${l}`)}return u})(e,"",0)}function qu(e){let t=e||bn,n=[],r={};return n.add=i=>{let a=t(i);return r[a]||(r[a]=1,n.push(i)),n},n.remove=i=>{let a=t(i);if(r[a]){r[a]=0;let o=n.indexO... L4: `),i!==vt.text&&(kn(t,0),o=t.ownerDocument,l=Ai(n),a.forEach((s,u)=>{let c=Si(o,"tspan",nt);c.__data__=n,c.textContent=s,u&&(c.setAttribute("x",0),c.setAttribute("dy",l)),t.appendC... L5: `;break;case"r":e+="\r";break;case"t":e+=" ";break;case"b":e+="\b";break;case"f":e+="\f";break;case"v":e+="\v";break;default:Rs(r)?(i="01234567".indexOf(r),i!==0&&(a=!0),z<wt&&Rs(Z...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/react-vega-DJIihc-q.jsView on unpkg · L3

dist/assets/loro_wasm_bg-BFCm9sQd.jsView file

1import{r as Ai}from"./chunk-LvLJmgfZ.js";let se,ae,ie,le,ge,ce,de,we,be,ue,pe,he,fe,me,ve,ye,xe,Se,Ce,Ae,Oe,Ie,Ne,Fe,De,Le,ke,Ee,Re,Te,Je,Ve,Ue,Pe,Be,Me,ze,je,We,He,qe,$e,Ke,Ge,Qe,... L2: ${_.stack}`:o}function n(_){let e=r.__wbindgen_export_4.get(_);return r.__externref_table_dealloc(_),e}function O(_,e){if(!(_ instanceof e))throw Error(`expected instance of ${e.na...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/loro_wasm_bg-BFCm9sQd.jsView on unpkg · L1

dist/assets/worker-Bp53hInb.jsView file

36L37: `)}t.write(`payload.value = newResult;`),t.write(`return payload;`);let s=t.compile();return(t,n)=>s(e,t,n)},a,o=we,s=!me.jitless,c=s&&Te.value,l=t.catchall,u;e._zod.parse=(d,f)=>{... L38: L39: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let n of e.seen.entries()){let r=n[1];if(t===n[0]){a(n);continue}if(e.external){let r=e.exter... L40: `).filter(function(t){return!!t.match(e)},this).map(function(e){e.indexOf(`(eval `)>-1&&(e=e.replace(/eval code/g,`eval`).replace(/(\(eval at [^()]*)|(,.*$)/g,``));var t=e.replace(... L41: `).filter(function(e){return!e.match(t)},this).map(function(e){if(e.indexOf(` > eval`)>-1&&(e=e.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,`:$1`)),e.indexOf(`@`)===... L42: print("[py] Starting marimo...")

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/worker-Bp53hInb.jsView on unpkg · L36

dist/assets/loro_wasm_bg-WKwciKJa.wasmView file

•path = dist/assets/loro_wasm_bg-WKwciKJa.wasm kind = wasm_module sizeBytes = 3263252 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/loro_wasm_bg-WKwciKJa.wasmView on unpkg

dist/export_demos/wasm-intro.pyView file

•path = dist/export_demos/wasm-intro.py kind = build_helper sizeBytes = 13544 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/export_demos/wasm-intro.pyView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/Plot-BB9gg44K.jsView file

•path = dist/assets/Plot-BB9gg44K.js kind = oversized_source_file sizeBytes = 4827160 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/Plot-BB9gg44K.jsView on unpkg

dist/assets/glide-data-editor-zlTMrHkt.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @marimo-team/frontend@0.23.13 matchedIdentity = npm:QG1hcmltby10ZWFtL2Zyb250ZW5k:0.23.13 similarity = 0.675 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/glide-data-editor-zlTMrHkt.jsView on unpkg

src/components/editor/connections/database/__tests__/as-code.test.tsView file

239patternName = generic_password severity = medium line = 239 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L239

279patternName = generic_password severity = medium line = 279 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L279

289patternName = generic_password severity = medium line = 289 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L289

438patternName = generic_password severity = medium line = 438 matchedText = password...&*",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L438

448patternName = generic_password severity = medium line = 448 matchedText = password...&*",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L448

547patternName = generic_password severity = medium line = 547 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L547

Findings

4 Critical6 High13 Medium6 Low

CriticalCritical Secretsrc/components/editor/connections/storage/__tests__/as-code.test.ts

CriticalPrevious Version Dangerous Deltadist/assets/glide-data-editor-zlTMrHkt.js

CriticalSecret Patternsrc/components/editor/connections/storage/__tests__/as-code.test.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/assets/dist-Dez1I5M9.js

HighShell

HighCommand Output Exfiltrationdist/assets/worker-Bp53hInb.js

HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Filedist/assets/Plot-BB9gg44K.js

MediumDynamic Requiredist/assets/loro_wasm_bg-BFCm9sQd.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/assets/loro_wasm_bg-WKwciKJa.wasm

MediumShips Build Helperdist/export_demos/wasm-intro.py

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/components/editor/connections/database/__tests__/as-code.test.ts

LowScripts Present

LowEvaldist/assets/react-vega-DJIihc-q.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

dist/assets/dist-Dez1I5M9.jsView file

Lines 1-15javascript

1var ah,vs=[],Cn=[];(()=>{let e="lc,34,7n,7,7b,19,,,,2,,2,,,20,b,1c,l,g,,2t,7,2,6,2,2,,4,z,,u,r,2j,b,1m,9,9,,o,4,,9,,3,,5,17,3,3b,f,,w,1j,,,,4,8,4,,3,7,a,2,t,,1m,,,,2,4,8,,9,,a,2,q,,2,2,1l,,4,2,4,2,2,3,3,,u,2,3,,b,2,1l,,4,5,,2,4,,k,2,m,6,,,1m,,,2,,4,8,,7,3,a,2,u,,1n,,,,c,,9,,14,,3,,1l,3,5,3,,4,7,2,b,2,t,,1m,,2,,2,,3,,5,2,7,2,b,2,s,2,1l,2,,,2,4,8,,9,,a,2,t,,20,,4,,2,3,,,8,,29,,2,7,c,8,2q,,2,9,b,6,22,2,r,,,,,,1j,e,,5,,2,5,b,,10,9,,2u,4,,6,,2,2,2,p,2,4,3,g,4,d,,2,2,6,,f,,jj,3,qa,3,t,3,t,2,u,2,1s,2,,7,8,,2,b,9,,19,3,3b,2,y,,3a,3,4,2,9,,6,3,63,2,2,,1m,,,7,,,,,2,8,6,a,2,,1c,h,1r,4,1c,7,,,5,,14,9,c,2, ...

2`){[t,i]=ge(this,t,i);let r="";for(let n=0,o=0;n<=i&&o<this.text.length;o++){let l=this.text[o],a=n+l.length;n>t&&o&&(r+=s),t<a&&i>n&&(r+=l.slice(Math.max(0,t-n),i-n)),n=a+1}return r}flatten(t){for(let i of this.text)t.push(i)}scanIdentical(){return 0}static split(t,i){let s=[],r=-1;for(let n of t)s.push(n),r+=n.length+1,s.length==32&&(i.push(new Ht(s,r)),s=[],r=-1);return r>-1&&i.push(new Ht(s,r)),i}},gi=class Ne extends I{constructor(t,i){super(),this.children=t,this.length=i,this.lines=0;for(let s of t)this.lines+=s.lines}lineInner(t,i,s,r){for(let n=0;;n++){let o=this.children[n],l=r+o.len ...

3`){[t,i]=ge(this,t,i);let r="";for(let n=0,o=0;n<this.children.length&&o<=i;n++){let l=this.children[n],a=o+l.length;o>t&&n&&(r+=s),t<a&&i>o&&(r+=l.sliceString(t-o,i-o,s)),o=a+1}return r}flatten(t){for(let i of this.children)i.flatten(t)}scanIdentical(t,i){if(!(t instanceof Ne))return 0;let s=0,[r,n,o,l]=i>0?[0,0,this.children.length,t.children.length]:[this.children.length-1,t.children.length-1,-1,-1];for(;;r+=i,n+=i){if(r==o||n==l)return s;let a=this.children[r],h=t.children[n];if(a!=h)return s+a.scanIdentical(h,i);s+=a.length+1}}static from(t,i=t.reduce((s,r)=>s+r.length+1,-1)){let s=0;for( ...

4`,this;e--}else if(s instanceof bt){let l=s.text[n+(t<0?-1:0)];if(this.offsets[i]+=t,l.length>Math.max(0,e))return this.value=e==0?l:t>0?l.slice(e):l.slice(0,l.length-e),this;e-=l.length}else{let l=s.children[n+(t<0?-1:0)];e>l.length?(e-=l.length,this.offsets[i]+=t):(t<0&&this.offsets[i]--,this.nodes.push(l),this.offsets.push(t>0?1:(l instanceof bt?l.text.length:l.children.length)<<1))}}}next(e=0){return e<0&&(this.nextInner(-e,-this.dir),e=this.value.length),this.nextInner(e,this.dir)}},En=class{constructor(e,t,i){this.value="",this.done=!1,this.cursor=new Le(e,t>i?-1:1),this.pos=t>i?e.length ...

5`}get readOnly(){return this.facet($n)}phrase(t,...i){for(let s of this.facet(Ct.phrases))if(Object.prototype.hasOwnProperty.call(s,t)){t=s[t];break}return i.length&&(t=t.replace(/\$(\$|\d*)/g,(s,r)=>{if(r=="$")

6`)}static newName(){let e=_n[Zn]||1;return _n[Zn]=e+1,Hs+e.toString(36)}static mount(e,t,i){let s=e[Vs],r=i&&i.nonce;s?r&&s.setNonce(r):s=new cc(e,r),s.mount(Array.isArray(t)?t:[t],e)}},to=new Map,cc=class{constructor(e,t){let i=e.ownerDocument||e,s=i.defaultView;if(!e.head&&e.adoptedStyleSheets&&s.CSSStyleSheet){let r=to.get(i);if(r)return e[Vs]=r;this.sheet=new s.CSSStyleSheet,to.set(i,this)}else this.styleTag=i.createElement("style"),t&&this.styleTag.setAttribute("nonce",t);this.modules=[],e[Vs]=this}mount(e,t){let i=this.sheet,s=0,r=0;for(let n=0;n<e.length;n++){let o=e[n],l=this.modules.i ...

7`;this.styleTag.textContent=n;let o=t.head||t;this.styleTag.parentNode!=o&&o.insertBefore(this.styleTag,o.firstChild)}}setNonce(e){this.styleTag&&this.styleTag.getAttribute("nonce")!=e&&this.styleTag.setAttribute("nonce",e)}},Jt={8:"Backspace",9:"Tab",10:"Enter",12:"NumLock",13:"Enter",16:

8`,r=e.state.doc.line(r.number+(i?1:-1)),n=e.bidiSpans(r),h=e.visualLineSide(r,!i)}if(a){if(!a(c))return l}else{if(!s)return h;a=s(c)}l=h}}function su(e,t,i){let s=e.state.charCategorizer(t),r=s(i);return n=>{let o=s(n);return r==Vt.Space&&(r=o),r==o}}function ru(e,t,i,s){let r=t.head,n=i?1:-1;if(r==(i?e.state.doc.length:0))return T.cursor(r,t.assoc);let o=t.goalColumn,l,a=e.contentDOM.getBoundingClientRect(),h=e.coordsAtPos(r,t.assoc||((t.empty?i:t.head==t.from)?1:-1)),c=e.documentTop;if(h)o??(o=h.left-a.left),l=n<0?h.top:h.bottom;else{let p=e.viewState.lineBlockAt(r);o??(o=Math.min(a.right-a. ...

9 `&&e.lineWrapping&&(s&&(s=T.single(s.main.anchor-1,s.main.head-1)),i={from:n.from,to:n.to,insert:I.of([" "])}),i)return mr(e,i,s,o);if(s&&!Ni(s,n)){let l=!1,a=

10`))};if((k.mac||k.android)&&u.from==o-1&&/^\. ?$/.test(s.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(u={from:l,to:a,insert:I.of([s.text.replace("."," ")])}),this.pendingContextChange=u,!e.state.readOnly){let f=this.to-this.from+(u.to-u.from+u.insert.length);mr(e,u,T.single(this.toEditorPos(s.selectionStart,f),this.toEditorPos(s.selectionEnd,f)))}this.pendingContextChange&&(this.revertPending(e.state),this.setSelection(e.state)),u.from<u.to&&!u.insert.length&&e.inputState.composing>=0&&!/[\\p{Alphabetic}\\p{Number}_]/.test(t.text.slice(Math.max(0,s.updateRangeStart-1),Math.min(t.te ...

11-\x7F-\x9F\xAD\u061C\u200B\u200E\u200F\u2028\u2029\u202D\u202E\u2066\u2067\u2069\uFEFF\uFFF9-\uFFFC]`,Ar),mf={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"carriage return",27:"escape",8203:"zero width space",8204:"zero width non-joiner",8205:"zero width joiner"

12`,f),p=d<0?u.length:d;if(p>f&&s(u.slice(f,p),c),d<0)break;r(),f=d+1}l=h}}zr(t,i,(h,c,u)=>{a(h,""),a(c,u)},n,o),a(o,"")}var Bd=class{constructor(e,t,i){this.at=e,this.highlighters=t,this.span=i,this.class=""}startSpan(e,t){t!=this.class&&(this.flush(e),e>this.at&&(this.at=e),this.class=t)}flush(e){e>this.at&&this.class&&this.span(this.at,e,this.class)}highlightRange(e,t,i,s,r){let{type:n,from:o,to:l}=e;if(o>=i||l<=t)return;n.isTop&&(r=this.highlighters.filter(f=>!f.scope||f.scope(n)));let a=s,h=Ed(e)||ni.empty,c=Dd(r,h.tags);if(c&&(a&&(a+=" "),a+=c,h.mode==1&&(s+=(s?" ":"")+c)),this.startSpan(M ...

High

Child Process

Package source references child process execution.

dist/assets/dist-Dez1I5M9.jsView on unpkg · L10

13`&&(t="");else{let i=t.indexOf(`

14`);i>-1&&(t=t.slice(0,i))}return e+t.length<=this.to?t:t.slice(0,this.to-e)}nextLine(){let e=this.parsedPos,t=this.lineAfter(e),i=e+t.length;for(let s=this.rangeIndex;;){let r

Long lines were clipped for display.

dist/assets/worker-Bp53hInb.jsView file

Lines 16-56javascript

16 }

17 } else {

18 newResult[${o}] = ${n}.value;

19 }

21 `):t.write(`

22 if (${n}.issues.length) {

23 payload.issues = payload.issues.concat(${n}.issues.map(iss => ({

24 ...iss,

25 path: iss.path ? [${o}, ...iss.path] : [${o}]

26 })));

27 }

29 if (${n}.value === undefined) {

30 if (${o} in input) {

31 newResult[${o}] = undefined;

32 }

33 } else {

34 newResult[${o}] = ${n}.value;

35 }

37 `)}t.write(`payload.value = newResult;`),t.write(`return payload;`);let s=t.compile();return(t,n)=>s(e,t,n)},a,o=we,s=!me.jitless,c=s&&Te.value,l=t.catchall,u;e._zod.parse=(d,f)=>{u??=r.value;let p=d.value;return o(p)?s&&c&&f?.async===!1&&f.jitless!==!0?(a||=i(t.shape),d=a(d,f),l?wn([],p,d,f,u,e):d):n(d,f):(d.issues.push({expected:`object`,code:`invalid_type`,input:p,inst:e}),d)}});function Dn(e,t,n,r){for(let n of e)if(n.issues.length===0)return t.value=n.value,t;let i=e.filter(e=>!D(e));return i.length===1?(t.value=i[0].value,i[0]):(t.issues.push({code:`invalid_union`,input:t.value,ins ...

39Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let n of e.seen.entries()){let r=n[1];if(t===n[0]){a(n);continue}if(e.external){let r=e.external.registry.get(n[0])?.id;if(t!==n[0]

40`).filter(function(t){return!!t.match(e)},this).map(function(e){e.indexOf(`(eval `)>-1&&(e=e.replace(/eval code/g,`eval`).replace(/($eval at [^()]*)|(,.*$)/g,``));var t=e.replace(/^\s+/,``).replace(/\(eval code/g,`(`).replace(/^.*?\s+/,``),n=t.match(/ (\(.+$$)/);t=n?t.replace(n[0],``):t;var r=this.extractLocation(n?n[1]:t);return new no({functionName:n&&t||void 0,fileName:[`eval`,`<anonymous>`].indexOf(r[0])>-1?void 0:r[0],lineNumber:r[1],columnNumber:r[2],source:e})},this)},`ErrorStackParser$$parseV8OrIE`),parseFFOrSafari:V(function(e){return e.stack.split(`

41`).filter(function(e){return!e.match(t)},this).map(function(e){if(e.indexOf(` > eval`)>-1&&(e=e.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,`:$1`)),e.indexOf(`@`)===-1&&e.indexOf(`:`)===-1)return new no({functionName:e});var t=/((.*".+"[^@]*)?[^@]*)(?:@)/,n=e.match(t),r=n&&n[1]?n[1]:void 0,i=this.extractLocation(e.replace(t,``));return new no({functionName:r,fileName:i[0],lineNumber:i[1],columnNumber:i[2],source:e})},this)},`ErrorStackParser$$parseFFOrSafari`)}}V(ro,`ErrorStackParser`);var io=new ro;function ao(){return typeof API<`u`&&API!==globalThis.API?API.runtimeEnv:oo({IN_ ...

42 print("[py] Starting marimo...")

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/worker-Bp53hInb.jsView on unpkg · L36

43 import asyncio

44 import js

45 from marimo._pyodide.bootstrap import create_session, instantiate

47 assert js.messenger, "messenger is not defined"

48 assert js.query_params, "query_params is not defined"

50 session, bridge = create_session(

51 filename="${s}",

52 query_params=js.query_params.to_py(),

53 message_callback=js.messenger.callback,

54 user_config=js.user_config.to_py(),

55 )

Long lines were clipped for display.

src/components/editor/connections/database/__tests__/as-code.test.tsView file

Lines 219-299typescript

219 };

220

221 const pysparkConnection: DatabaseConnection = {

222 type: "pyspark",

223 };

224

225 const pysparkConnSession: DatabaseConnection = {

226 type: "pyspark",

227 host: "localhost",

228 port: 15_002,

229 };

230

231 const redshiftDBConnection: DatabaseConnection = {

232 type: "redshift",

233 host: "localhost",

234 port: 5439,

235 database: "test",

236 connectionType: {

237 type: "DB credentials",

238 user: "my_user",

239 password: "my_password",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L239

240 },

241 };

242

243 const redshiftIAMConnection: DatabaseConnection = {

244 type: "redshift",

245 host: "localhost",

246 port: 5439,

247 database: "test",

248 connectionType: {

249 type: "IAM credentials",

250 aws_access_key_id: "my_access_key_id",

251 aws_secret_access_key: "my_secret_access_key",

252 aws_session_token: "my_session_token",

253 region: "ap-southeast-1",

254 },

255 };

256

257 const databricksConnection: DatabaseConnection = {

258 type: "databricks",

259 access_token: "my_access_token",

260 server_hostname: "localhost",

261 http_path: "http://localhost:8080",

262 };

263

264 const databricksWithCatalogSchema: DatabaseConnection = {

265 type: "databricks",

266 access_token: "my_access_token",

267 server_hostname: "localhost",

268 http_path: "http://localhost:8080",

269 catalog: "my_catalog",

270 schema: "my_schema",

271 };

272

273 const supabaseConnection: DatabaseConnection = {

274 type: "supabase",

275 host: "db.example.supabase.co",

276 port: 5432,

277 database: "postgres",

278 username: "postgres",

279 password: "my_password",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L279

280 disable_client_pooling: false,

281 };

282

283 const supabaseWithPooling: DatabaseConnection = {

284 type: "supabase",

285 host: "db.example.supabase.co",

286 port: 6543,

287 database: "postgres",

288 username: "postgres.session",

289 password: "my_password",

290 disable_client_pooling: true,

291 };

292

293 describe("basic connections", () => {

294 const testCases: [string, DatabaseConnection, ConnectionLibrary][] = [

295 ["postgres with SQLModel", basePostgres, "sqlmodel"],

296 ["postgres with SQLAlchemy", basePostgres, "sqlalchemy"],

297 ["mysql with SQLModel", baseMysql, "sqlmodel"],

298 ["mysql with SQLAlchemy", baseMysql, "sqlalchemy"],

299 ["sqlite", sqliteConnection, "sqlmodel"],

289patternName = generic_password severity = medium line = 289 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L289

438patternName = generic_password severity = medium line = 438 matchedText = password...&*",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L438

448patternName = generic_password severity = medium line = 448 matchedText = password...&*",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L448

547patternName = generic_password severity = medium line = 547 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/components/editor/connections/database/__tests__/as-code.test.ts

src/components/editor/connections/database/__tests__/as-code.test.tsView on unpkg · L547