registry / @marimo-team/islands / 0.23.12

@marimo-team/islands@0.23.12

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 26 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,444 file(s), 19.6 MB of source, external domains: 127.0.0.1, aistudio.google.com, anywidget.dev, api.example.com, api.iconify.design, api.inference.wandb.ai, api.openai.com, api.simplesvg.com, api.together.xyz, api.unisvg.com, cdn.example.com, cdn.jsdelivr.net, chevrotain.io, chriskempson.com, console.anthropic.com, developer.mozilla.org, docs.github.com, docs.marimo.io, docs.python.org, en.wikipedia.org, evil.com, evil.example.com, example.com, fb.me, git.new, github.com, json-schema.org, langium.org, links.marimo.app, marimo.app, marimo.io, models.github.ai, molab.marimo.io, mui.com, opencode.ai, openrouter.ai, platform.openai.com, portal.azure.com, pypi.org, radix-ui.com, raw.githubusercontent.com, react.dev, s3.amazonaws.com, static.marimo.app, unpkg.com, vega.github.io, vlaaad.github.io, wandb.ai, wasm.marimo.app, www.google.com

Oversized source lightweight scan

dist/Plot-CAYS29h9.js8.00 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsUrlStringswww.w3.org

dist/node-sql-parser-B8nBD36q.js4.39 MB file, sampled 256 KB

HighEntropyStrings

Source & flagged code

17 flagged

package.jsonView file

Lines 149-189json

149 "streamdown": "^2.1.0",

150 "string-dedent": "^3.0.2",

151 "swiper": "^12.0.0",

152 "tailwind-merge": "^2.6.0",

153 "tailwindcss-animate": "^1.0.7",

154 "thememirror": "^2.0.1",

155 "timestring": "^7.0.0",

156 "typescript-memoize": "^1.1.1",

157 "use-acp": "0.2.6",

158 "use-resize-observer": "^9.1.0",

159 "vega-lite": "6.4.2",

160 "vega-loader": "^5.1.0",

161 "vega-parser": "^7.1.0",

162 "vega-tooltip": "^1.1.0",

163 "vscode-jsonrpc": "^8.2.1",

164 "vscode-languageserver-protocol": "^3.17.5",

165 "web-vitals": "^4.2.4",

166 "zod": "^4.3.6"

167 },

168 "scripts": {

169 "preinstall": "npx only-allow pnpm",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L169

170 "ci": "cross-env CI=true run-s lint typecheck test build",

171 "start": "vite",

172 "dev": "vite",

173 "build:watch": "vite build --watch --outDir ../marimo/_static",

174 "build": "cross-env vite build",

175 "test": "vitest",

176 "typecheck": "tsgo",

177 "format": "oxfmt --config ../.oxfmtrc.json",

178 "lint": "run-s lint:oxlint lint:stylelint",

179 "lint:oxlint": "oxlint --fix",

180 "lint:stylelint": "stylelint src/**/*.css --fix",

181 "preview": "vite preview",

182 "dev:quarto": "VITE_MARIMO_ISLANDS=true vite",

183 "dev:islands": "cross-env VITE_MARIMO_ISLANDS=true vite --config islands/vite.config.mts",

184 "build:islands": "cross-env VITE_MARIMO_ISLANDS=true vite --config islands/vite.config.mts build",

185 "preview:islands": "cross-env VITE_MARIMO_VERSION='0.4.6' VITE_MARIMO_ISLANDS=true vite --config islands/vite.config.mts build",

186 "storybook": "storybook dev -p 6006",

187 "build-storybook": "storybook build"

188 },

189 "peerDependencies": {

src/components/editor/connections/storage/__tests__/as-code.test.tsView file

Lines 1-32typescript

2import { describe, expect, it } from "vitest";

3import { prefixSecret } from "../../secrets";

4import { generateStorageCode } from "../as-code";

5import type { StorageConnection } from "../schemas";

dist/dist-U4F-tbMs.jsView file

Lines 8416-8456javascript

8416 constructor(e64, w) {

8417 this.buffer = e64, this.index = w;

8418 }

8419 get id() {

8420 return this.buffer[this.index - 4];

8421 }

dist/react-vega-B0sAlDTL.jsView file

12832}, L12833: eval(t35, n) { L12834: let r = n.materialize().fork(), a = this._dims.length, o = 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/react-vega-B0sAlDTL.jsView on unpkg · L12832

dist/livescript-BJLz1EbT.jsView file

Lines 1-35javascript

1var tokenBase = function(e, l) {

2 var u = l.next || "start";

3 if (u) {

4 l.next = l.next;

5 var d = Rules[u];

dist/assets/worker-DEDLIQQV.jsView file

Lines 1-21javascript

dist/files/wasm-intro.pyView file

•path = dist/files/wasm-intro.py kind = build_helper sizeBytes = 13544 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/files/wasm-intro.pyView on unpkg

src/fonts/KaTeX/KaTeX_Typewriter-Regular.woff2View file

•path = src/fonts/KaTeX/KaTeX_Typewriter-Regular.woff2 kind = high_entropy_blob sizeBytes = 13568 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/fonts/KaTeX/KaTeX_Typewriter-Regular.woff2View on unpkg

dist/Plot-CAYS29h9.jsView file

•path = dist/Plot-CAYS29h9.js kind = oversized_source_file sizeBytes = 8384833 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/Plot-CAYS29h9.jsView on unpkg

src/components/editor/connections/database/__tests__/as-code.test.tsView file

Lines 219-299typescript

219 };

220

221 const pysparkConnection: DatabaseConnection = {

222 type: "pyspark",

223 };

224

225 const pysparkConnSession: DatabaseConnection =

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.preinstall = npx only-allow pnpm

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/components/editor/connections/storage/__tests__/as-code.test.tsView file

12patternName = aws_access_key severity = critical line = 12 matchedText = access_k...LE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L12

12patternName = aws_access_key severity = critical line = 12 matchedText = access_k...LE",

Critical

Secret Pattern

AWS access key ID in src/components/editor/connections/storage/__tests__/as-code.test.ts

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L12

34patternName = aws_access_key severity = critical line = 34 matchedText = access_k...LE",

Critical

Secret Pattern

AWS access key ID in src/components/editor/connections/storage/__tests__/as-code.test.ts

src/components/editor/connections/storage/__tests__/as-code.test.tsView on unpkg · L34

dist/dist-U4F-tbMs.jsView file

8436} L8437: fork() { L8438: return new e47(this.buffer, this.index);

High

Child Process

Package source references child process execution.

dist/dist-U4F-tbMs.jsView on unpkg · L8436

dist/react-vega-B0sAlDTL.jsView file

12832}, L12833: eval(t35, n) { L12834: let r = n.materialize().fork(), a = this._dims.length, o = 0;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/react-vega-B0sAlDTL.jsView on unpkg · L12832

dist/livescript-BJLz1EbT.jsView file

15return e.next(), "error"; L16: }, identifier = "(?![\\d\\s])[$\\w\\xAA-\\uFFDC](?:(?!\\s)[$\\w\\xAA-\\uFFDC]|-[A-Za-z])*", indenter = RegExp("(?:[({[=:]|[-~]>|\\b(?:e(?:lse|xport)|d(?:o|efault)|t(?:ry|hen)|final... L17: token: "string",

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/livescript-BJLz1EbT.jsView on unpkg · L15

dist/assets/worker-DEDLIQQV.jsView file

1var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t... L2: `).filter(function(t){return!!t.match(e)},this).map(function(e){e.indexOf(`(eval `)>-1&&(e=e.replace(/eval code/g,`eval`).replace(/(\(eval at [^()]*)|(,.*$)/g,``));var t=e.replace(... L3: `).filter(function(e){return!e.match(t)},this).map(function(e){if(e.indexOf(` > eval`)>-1&&(e=e.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,`:$1`)),e.indexOf(`@`)===... L4: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/worker-DEDLIQQV.jsView on unpkg · L1

dist/files/wasm-intro.pyView file

•path = dist/files/wasm-intro.py kind = build_helper sizeBytes = 13544 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/files/wasm-intro.pyView on unpkg

src/fonts/KaTeX/KaTeX_Typewriter-Regular.woff2View file

•path = src/fonts/KaTeX/KaTeX_Typewriter-Regular.woff2 kind = high_entropy_blob sizeBytes = 13568 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/fonts/KaTeX/KaTeX_Typewriter-Regular.woff2View on unpkg

dist/Plot-CAYS29h9.jsView file

•path = dist/Plot-CAYS29h9.js kind = oversized_source_file sizeBytes = 8384833 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/Plot-CAYS29h9.jsView on unpkg

src/components/editor/connections/database/__tests__/as-code.test.tsView file

239patternName = generic_password severity = medium line = 239 matchedText = password...rd",

Medium

Secret Pattern