registry / @ninebone/ux / 1.0.48

@ninebone/ux@1.0.48

⚠ Under review

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 831 KB of source, external domains: cdn.jsdelivr.net, developer.mozilla.org, prosemirror.net, w3c.github.io, www.w3.org

Source & flagged code

2 flagged

dist/nine-ux.jsView file

Lines 1685-1725javascript

1685 let o = [];

1686 for (let l = i; l.type; l = l.via)

1687 o.push(l.type);

1688 return o.reverse();

1689 }

1690 for (let o = 0; o < s.next.length; o++) {

1691 let { type: l, next: a } = s.next[o];

1692 !l.isLeaf && !l.hasRequiredAttrs() && !(l.name in t) && (!i.type || a.validEnd) && (n.push({ match: l.contentMatch, type: l, via: i }), t[l.name] = !0);

1693 }

1694 }

1695 return null;

1696 }

1697 /**

1698 The number of outgoing edges this node has in the finite

1699 automaton that describes the content expression.

1700 */

1701 get edgeCount() {

1702 return this.next.length;

1703 }

1704 /**

1705 Get the _n_th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/nine-ux.jsView on unpkg · L1705

1706 automaton that describes the content expression.

1707 */

1708 edge(e) {

1709 if (e >= this.next.length)

1710 throw new RangeError(`There's no ${e}th edge in this content match`);

1711 return this.next[e];

1712 }

1713 /**

1714 @internal

1715 */

1716 toString() {

1717 let e = [];

1718 function t(n) {

1719 e.push(n);

1720 for (let i = 0; i < n.next.length; i++)

1721 e.indexOf(n.next[i].next) == -1 && t(n.next[i].next);

1722 }

1723 return t(this), e.map((n, i) => {

1724 let s = i + (n.validEnd ? "*" : " ") + " ";

1725 for (let o = 0; o < n.next.length; o++)

•Trigger-reachable chain: manifest.module -> dist/nine-ux.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/nine-ux.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/nine-ux.jsView file

1705contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/nine-ux.jsView on unpkg · L1705

•Trigger-reachable chain: manifest.module -> dist/nine-ux.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/nine-ux.jsView on unpkg

Findings

2 Critical1 Medium4 Low

CriticalTrojan Source Unicodedist/nine-ux.js

CriticalTrigger Reachable Dangerous Capabilitydist/nine-ux.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/nine-ux.jsView file

Lines 1685-1725javascript

1685 let o = [];

1686 for (let l = i; l.type; l = l.via)

1687 o.push(l.type);

1688 return o.reverse();

1689 }

1690 for (let o = 0; o < s.next.length; o++) {

1691 let { type: l, next: a } = s.next[o];

1692 !l.isLeaf && !l.hasRequiredAttrs() && !(l.name in t) && (!i.type || a.validEnd) && (n.push({ match: l.contentMatch, type: l, via: i }), t[l.name] = !0);

1693 }

1694 }

1695 return null;

1696 }

1697 /**

1698 The number of outgoing edges this node has in the finite

1699 automaton that describes the content expression.

1700 */

1701 get edgeCount() {

1702 return this.next.length;

1703 }

1704 /**

1705 Get the _n_th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/nine-ux.jsView on unpkg · L1705

1706 automaton that describes the content expression.

1707 */

1708 edge(e) {

1709 if (e >= this.next.length)

1710 throw new RangeError(`There's no ${e}th edge in this content match`);

1711 return this.next[e];

1712 }

1713 /**

1714 @internal

1715 */

1716 toString() {

1717 let e = [];

1718 function t(n) {

1719 e.push(n);

1720 for (let i = 0; i < n.next.length; i++)

1721 e.indexOf(n.next[i].next) == -1 && t(n.next[i].next);

1722 }

1723 return t(this), e.map((n, i) => {

1724 let s = i + (n.validEnd ? "*" : " ") + " ";

1725 for (let o = 0; o < n.next.length; o++)

•Trigger-reachable chain: manifest.module -> dist/nine-ux.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/nine-ux.jsView on unpkg