@metuur/visual-spec: Suspicious npm security report (Warn)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 68 file(s), 4.97 MB of source, external domains: chevrotain.io, en.wikipedia.org, example.com, github.com, jquery.org, langium.org, lea.verou.me, lexical.dev, lodash.com, openjsf.org, opensource.org, reactjs.org, tldrlegal.com, underscorejs.org, www.ibm.com, www.w3.org, www.youtube-nocookie.com, www.youtube.com, youtube.com

Source & flagged code

4 flagged

dist/ui/assets/index-DEATWSil.jsView file

1var q9=Object.defineProperty;var K9=(t,e,n)=>e in t?q9(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var pe=(t,e,n)=>K9(t,typeof e!="symbol"?e+"":e,n);(function()... L2: * @license React ... L36: `),F=E.length-1,ne=P.length-1;1<=F&&0<=ne&&E[F]!==P[ne];)ne--;for(;1<=F&&0<=ne;F--,ne--)if(E[F]!==P[ne]){if(F!==1||ne!==1)do if(F--,ne--,0>ne||E[F]!==P[ne]){var le=` L37: `+E[F].replace(" at new "," at ");return c.displayName&&le.includes("<anonymous>")&&(le=le.replace("<anonymous>",c.displayName)),le}while(1<=F&&0<=ne);break}}}finally{W=!1,Error.pr... L38: `).replace(u9,"")}function Lm(c,f,m){if(f=$_(f),$_(c)!==f&&m)throw Error(n(425))}function $m(){}var Qb=null,Fb=null;function Bb(c,f){return c==="textarea"||c==="noscript"||typeof f... ... L68: coverage/ L69: **/*.snap`}),y.jsxs("ul",{style:EU,children:[y.jsxs("li",{children:[y.jsx(Bs,{children:".git/"}),", ",y.jsx(Bs,{children:"node_modules/"}),", and the comments sidecar are ",y.jsx("... L70: L71: ${f7(t)}`}const Vk={phase:"idle",startedAt:null,rows:[],summary:"",applied:[],agents:[]};function gM(t,e){switch(e.type){case"sync":{let n={...Vk,startedAt:e.startedAt};for(const r... L72: `,u="/",d="*",h="",p="comment"

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/ui/assets/index-DEATWSil.jsView on unpkg · L1

115`&&t.lineWrapping&&(r&&(r=Me.single(r.main.anchor-1,r.main.head-1)),n={from:s.from,to:s.to,insert:An.of([" "])}),n)return DT(t,n,r,o);if(r&&!py(r,s)){let l=!1,a="select";return t.i... L116: `))};if((gt.mac||gt.android)&&h.from==o-1&&/^\. ?$/.test(r.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(h={from:l,to:a,insert:An.of([r.text.replace("."," ")])}),this.pe... L117: `+n.scrub(),s=this.advance(i);return s>-1&&s<i.length?this.complete(e,r,s):!1}finish(e,n){return(this.stage==2||this.stage==3)&&Kp(n.content,this.pos)==n.content.length?this.comple...

High

Child Process

Package source references child process execution.

dist/ui/assets/index-DEATWSil.jsView on unpkg · L115

206`)},regExpStart:/^\|.*\|$/,regExpEnd:{optional:!0,regExp:/^$/},replace:(t,e,n,r,i,s)=>{let o=n[0];if(!o)return;let l=[o,...i??[]].filter(x=>typeof x=="string").filter(x=>{let k=x.t... L207: `)}function s1(t){return t.trim().toLowerCase().replace(/^:+|:+$/g,"")}function gme(t){return Array.isArray(t)?t.map(e=>typeof e=="string"?s1(e):"").filter(e=>e.length>0):typeof t=... L208: `),n=[],r=null;for(let i of e){let s=rl(i);if(s){r&&s.marker===r.marker&&s.length>=r.length?r=null:r||(r=s),n.push(i);continue}if(r){n.push(i);continue}n.push($p(i))}return n.join(...

High

Eval

Package source references dynamic code evaluation.

dist/ui/assets/index-DEATWSil.jsView on unpkg · L206

103L104: ${e}`}const pte="modulepreload",gte=function(t){return"/"+t},cN={},mte=function(e,n,r){let i=Promise.resolve();if(n&&n.length>0){let o=function(u){return Promise.all(u.map(d=>Promi... L105: `)||/\blanguage-/.test(n??"")))return y.jsx("code",{className:n,...i,children:r});const l=s.replace(/\n$/,"").split(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/assets/index-DEATWSil.jsView on unpkg · L103

Source & flagged code

4 flagged · loading source

dist/ui/assets/index-DEATWSil.jsView file

1var q9=Object.defineProperty;var K9=(t,e,n)=>e in t?q9(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var pe=(t,e,n)=>K9(t,typeof e!="symbol"?e+"":e,n);(function()... L2: * @license React ... L36: `),F=E.length-1,ne=P.length-1;1<=F&&0<=ne&&E[F]!==P[ne];)ne--;for(;1<=F&&0<=ne;F--,ne--)if(E[F]!==P[ne]){if(F!==1||ne!==1)do if(F--,ne--,0>ne||E[F]!==P[ne]){var le=` L37: `+E[F].replace(" at new "," at ");return c.displayName&&le.includes("<anonymous>")&&(le=le.replace("<anonymous>",c.displayName)),le}while(1<=F&&0<=ne);break}}}finally{W=!1,Error.pr... L38: `).replace(u9,"")}function Lm(c,f,m){if(f=$_(f),$_(c)!==f&&m)throw Error(n(425))}function $m(){}var Qb=null,Fb=null;function Bb(c,f){return c==="textarea"||c==="noscript"||typeof f... ... L68: coverage/ L69: **/*.snap`}),y.jsxs("ul",{style:EU,children:[y.jsxs("li",{children:[y.jsx(Bs,{children:".git/"}),", ",y.jsx(Bs,{children:"node_modules/"}),", and the comments sidecar are ",y.jsx("... L70: L71: ${f7(t)}`}const Vk={phase:"idle",startedAt:null,rows:[],summary:"",applied:[],agents:[]};function gM(t,e){switch(e.type){case"sync":{let n={...Vk,startedAt:e.startedAt};for(const r... L72: `,u="/",d="*",h="",p="comment"

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/ui/assets/index-DEATWSil.jsView on unpkg · L1

115`&&t.lineWrapping&&(r&&(r=Me.single(r.main.anchor-1,r.main.head-1)),n={from:s.from,to:s.to,insert:An.of([" "])}),n)return DT(t,n,r,o);if(r&&!py(r,s)){let l=!1,a="select";return t.i... L116: `))};if((gt.mac||gt.android)&&h.from==o-1&&/^\. ?$/.test(r.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(h={from:l,to:a,insert:An.of([r.text.replace("."," ")])}),this.pe... L117: `+n.scrub(),s=this.advance(i);return s>-1&&s<i.length?this.complete(e,r,s):!1}finish(e,n){return(this.stage==2||this.stage==3)&&Kp(n.content,this.pos)==n.content.length?this.comple...

High

Child Process

Package source references child process execution.

dist/ui/assets/index-DEATWSil.jsView on unpkg · L115

206`)},regExpStart:/^\|.*\|$/,regExpEnd:{optional:!0,regExp:/^$/},replace:(t,e,n,r,i,s)=>{let o=n[0];if(!o)return;let l=[o,...i??[]].filter(x=>typeof x=="string").filter(x=>{let k=x.t... L207: `)}function s1(t){return t.trim().toLowerCase().replace(/^:+|:+$/g,"")}function gme(t){return Array.isArray(t)?t.map(e=>typeof e=="string"?s1(e):"").filter(e=>e.length>0):typeof t=... L208: `),n=[],r=null;for(let i of e){let s=rl(i);if(s){r&&s.marker===r.marker&&s.length>=r.length?r=null:r||(r=s),n.push(i);continue}if(r){n.push(i);continue}n.push($p(i))}return n.join(...

High

Eval

Package source references dynamic code evaluation.

dist/ui/assets/index-DEATWSil.jsView on unpkg · L206

103L104: ${e}`}const pte="modulepreload",gte=function(t){return"/"+t},cN={},mte=function(e,n,r){let i=Promise.resolve();if(n&&n.length>0){let o=function(u){return Promise.all(u.map(d=>Promi... L105: `)||/\blanguage-/.test(n??"")))return y.jsx("code",{className:n,...i,children:r});const l=s.replace(/\n$/,"").split(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/assets/index-DEATWSil.jsView on unpkg · L103

Findings

1 Critical3 High5 Medium7 Low

CriticalDownload Executedist/ui/assets/index-DEATWSil.js

HighChild Processdist/ui/assets/index-DEATWSil.js

HighShell

HighEvaldist/ui/assets/index-DEATWSil.js

MediumDynamic Requiredist/ui/assets/index-DEATWSil.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License