Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@mlightcad/cad-simple-viewer: Suspicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 11 finding(s) warrant review before installing.

View on npm All versions

registry / @mlightcad/cad-simple-viewer / 1.5.8

@mlightcad/cad-simple-viewer@1.5.8

⚠ Under review

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![npm version](https://img.shields.io/npm/v/@mlightcad/cad-simple-viewer.svg)](https://www.npmjs.com/package/@mlightcad/cad-simple-viewer)

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 250 file(s), 5.41 MB of source, external domains: cdn.jsdelivr.net, feross.org, github.com, help.autodesk.com, www.w3.org

Oversized source lightweight scan

dist/cad-simple-viewer.js2.39 MB file, sampled 256 KB

ChildProcessEnvironmentVarsHighEntropyStringsUrlStrings

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

cdn.jsdelivr.net

www.w3.org

dist/libredwg-parser-worker.js12.9 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsUrlStringswww.w3.org

Source & flagged code

4 flagged · loading source

dist/cad-simple-viewer.umd.cjsView file

10contains invisible/control Unicode U+200B (zero width space) \v\f\r\x1B !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟¢ﺀﺁﺃﺅﻊﺋﺍﺑﺓﺗﺛﺟﺣﺧﺩﺫﺭﺯﺳﺷﺻﺿﻁﻅﻋﻏ¦¬÷×ﻉـﻓﻗﻛﻟﻣﻧﻫﻭﻯﻳﺽﻌﻎﻍﻡﹽّﻥ

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/cad-simple-viewer.umd.cjsView on unpkg · L10

•Trigger-reachable chain: manifest.main -> dist/cad-simple-viewer.umd.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cad-simple-viewer.umd.cjsView on unpkg

1(function(T,g){typeof exports=="object"&&typeof module<"u"?g(exports,require("@mlightcad/data-model"),require("three"),require("[redacted].js"),require(... L2: \r\f\v`.indexOf(m)>-1?a.push(""):m==="."?!o.type||w.indexOf(m)>-1?l=!0:a[a.length-1]+=m:l=!0}if(l)throw new Error("Unexpected character: "+m+" at offset "+f)}u.apply(this),e.optimi...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cad-simple-viewer.umd.cjsView on unpkg · L1

dist/libredwg-parser-worker.jsView file

•path = dist/libredwg-parser-worker.js kind = oversized_source_file sizeBytes = 13568963 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/libredwg-parser-worker.jsView on unpkg

Findings

2 Critical1 High4 Medium4 Low

CriticalTrojan Source Unicodedist/cad-simple-viewer.umd.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/cad-simple-viewer.umd.cjs

HighOversized Source Filedist/libredwg-parser-worker.js

MediumDynamic Requiredist/cad-simple-viewer.umd.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

86%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Maintainersmlight.li

Version1.5.8

PublishedJul 19, 2026

LicenseMIT

Dependencies4

Integrityverified

Package size5.40 MB

Files996

Keywordsautocadcadcad-viewerdwgdwg-viewerdxfdxf-viewermlight

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/cad-simple-viewer.umd.cjsmodule → ./dist/cad-simple-viewer.jstypes → ./lib/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact22.1 MB · 996 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, clean, lint, lint:fix

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkHighEntropyStringsMinifiedUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

dist/cad-simple-viewer.umd.cjsView file

10contains invisible/control Unicode U+200B (zero width space) \v\f\r\x1B !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟¢ﺀﺁﺃﺅﻊﺋﺍﺑﺓﺗﺛﺟﺣﺧﺩﺫﺭﺯﺳﺷﺻﺿﻁﻅﻋﻏ¦¬÷×ﻉـﻓﻗﻛﻟﻣﻧﻫﻭﻯﻳﺽﻌﻎﻍﻡﹽّﻥ

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/cad-simple-viewer.umd.cjsView on unpkg · L10

•Trigger-reachable chain: manifest.main -> dist/cad-simple-viewer.umd.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cad-simple-viewer.umd.cjsView on unpkg

1(function(T,g){typeof exports=="object"&&typeof module<"u"?g(exports,require("@mlightcad/data-model"),require("three"),require("[redacted].js"),require(... L2: \r\f\v`.indexOf(m)>-1?a.push(""):m==="."?!o.type||w.indexOf(m)>-1?l=!0:a[a.length-1]+=m:l=!0}if(l)throw new Error("Unexpected character: "+m+" at offset "+f)}u.apply(this),e.optimi...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cad-simple-viewer.umd.cjsView on unpkg · L1

dist/libredwg-parser-worker.jsView file

•path = dist/libredwg-parser-worker.js kind = oversized_source_file sizeBytes = 13568963 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/libredwg-parser-worker.jsView on unpkg