registry / @objectstack/console / 12.0.0

@objectstack/console@12.0.0

⚠ Under review

Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 481 file(s), 24.0 MB of source, external domains: api.qrserver.com, app.example.com, bit.ly, cdn.jsdelivr.net, chevrotain.io, cloud.objectos.app, demotiles.maplibre.org, docs.sentry.io, en.wikipedia.org, example.com, github.com, grainy-gradients.vercel.app, json-schema.org, langium.org, mystorageaccount.blob.core.windows.net, o447951.ingest.sentry.io, react.dev, reactrouter.com, redux-toolkit.js.org, redux.js.org, rolldown.rs, schemas.openxmlformats.org, sentry.io, spotlightjs.com, stuk.github.io, www.google.com, www.ibm.com, www.w3.org

Source & flagged code

3 flagged

dist/assets/src-BvIm_4jD.jsView file

Lines 113-135javascript

113 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

114 return result == null ? true : result;

115 }

116 `},qt=class e{__init(){this.helperNames={}}__init2(){this.createRequireName=null}constructor(t){this.nameManager=t,e.prototype.__init.call(this),e.prototype.__init2.call(this)}getHelperName(e){let t=this.helperNames[e];return t||(t=this.nameManager.claimFreeName(`_${e}`),this.helperNames[e]=t,t)}emitHelpers(){let e=``;this.helperNames.optionalChainDelete&&this.getHelperName(`optionalChain`),this.helperNames.asyncOptionalChainDelete&&this.getHelperName(`asyncOptionalChain`);for(let[t,n]of Object.entries(Kt)){let r=this.helperNames[t],i=n;t===`optionalChainDelete`?i=i.replace(`OPTIONAL_CHAIN_N ...

117module.exports = exports.default;

118`:``}process(){return this.tokens.matches3(a._import,a.name,a.eq)?this.processImportEquals():this.tokens.matches1(a._import)?(this.processImport(),!0):this.tokens.matches2(a._export,a.eq)?(this.tokens.replaceToken(`module.exports`),!0):this.tokens.matches1(a._export)&&!this.tokens.currentToken().isType?(this.hadExport=!0,this.processExport()):this.tokens.matches2(a.name,a.postIncDec)&&this.processPostIncDec()?!0:this.tokens.matches1(a.name)||this.tokens.matches1(a.jsxName)?this.processIdentifier():this.tokens.matches1(a.eq)?this.processAssignment():this.tokens.matches1(a.assign)?this.processCo ...

119 (function () {

120 var enterModule = require('react-hot-loader').enterModule;

121 enterModule && enterModule(module);

122 })();`.replace(/\s+/g,` `).trim()}getSuffixCode(){let e=new Set;for(let t of this.tokens.tokens)!t.isType&&he(t)&&t.identifierRole!==O.ImportDeclaration&&e.add(this.tokens.identifierNameForToken(t));let t=

123;(function () {

124 var reactHotLoader = require('react-hot-loader').default;

125 var leaveModule = require('react-hot-loader').leaveModule;

126 if (!reactHotLoader) {

127 return;

128 }

129${t.map(({variableName:e,uniqueLocalName:t})=>` reactHotLoader.register(${e}, "${t}", ${JSON.stringify(this.filePath||``)});`).join(`

130`)}

131 leaveModule(module);

132})();`}process(){return!1}},pc=new Set(`break.case.catch.class.const.continue.debugger.default.delete.do.else.export.extends.finally.for.function.if.import.in.instanceof.new.return.super.switch.this.throw.try.typeof.var.void.while.with.yield.enum.implements.interface.let.package.private.protected.public.static.await.false.null.true`.split(`.`));function mc(e){if(e.length===0||!D[e.charCodeAt(0)])return!1;for(let t=1;t<

133`);return i===-1&&(i=r.length,r+=`

134`),{code:r.slice(0,i+1)+e+r.slice(i+1)+t,mappings:this.shiftMappings(n.mappings,e.length)}}else return{code:e+r+t,mappings:this.shiftMappings(n.mappings,e.length)}}processBalancedCode(){let e=0,t=0;for(;!this.tokens.isAtEnd();){if(this.tokens.matches1(a.braceL)||this.tokens.matches1(a.dollarBraceL))e++;else if(this.tokens.matches1(a.braceR)){if(e===0)return;e--}if(this.tokens.matches1(a.parenL))t++;else if(this.tokens.matches1(a.parenR)){if(t===0)return;t--}this.processToken()}}processToken(){if(this.tokens.matches1(a._class)){this.processClass();return}for(let e of this.transformers)if(e.proc ...

135`,n=`\r`;e.LinesAndColumns=function(){function e(e){this.string=e;for(var r=[0],i=0;i<e.length;)switch(e[i]){case t:i+=t.length,r.push(i);break;case n:i+=

Long lines were clipped for display.

dist/assets/jsx-C97fCUqH.jsView file

Lines 1-1javascript

1import{r as e}from"./rolldown-runtime-DAXXjFlN.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse(`{"displayName":"JSX","name":"jsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![$_[:alnum:]])(?:(?<=\\\\.\\\\.\\\\.)|(?<!\\\\.))(abstract|declare|override|public|protected|private|readonly|static)(?![$_[:alnum:]])(?:(?=\\\\.\\\\

dist/assets/chunk-KEIR6QF5-MVybfwhZ.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Da(e){let t=typeof e==`string`?new RegExp(e):e;return Ea.some(e=>t.test(e))}o(Da,`isWhitespace`);function Oa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(Oa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/chunk-KEIR6QF5-MVybfwhZ.jsView on unpkg · L46

Source & flagged code

3 flagged · loading source

dist/assets/src-BvIm_4jD.jsView file

133`);return i===-1&&(i=r.length,r+=` L134: `),{code:r.slice(0,i+1)+e+r.slice(i+1)+t,mappings:this.shiftMappings(n.mappings,e.length)}}else return{code:e+r+t,mappings:this.shiftMappings(n.mappings,e.length)}}processBalancedC... L135: `,n=`\r`;e.LinesAndColumns=function(){function e(e){this.string=e;for(var r=[0],i=0;i<e.length;)switch(e[i]){case t:i+=t.length,r.push(i);break;case n:i+=n.length,e[i]===t&&(i+=t.l...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/src-BvIm_4jD.jsView on unpkg · L133

dist/assets/jsx-C97fCUqH.jsView file

1import{r as e}from"./rolldown-runtime-DAXXjFlN.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse(`{"displayName":"JSX","name":"jsx","patterns":[{"include":"#directives"},{"i...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/jsx-C97fCUqH.jsView on unpkg · L1

dist/assets/chunk-KEIR6QF5-MVybfwhZ.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/chunk-KEIR6QF5-MVybfwhZ.jsView on unpkg · L46

Findings

1 Critical5 Medium5 Low

CriticalTrojan Source Unicodedist/assets/chunk-KEIR6QF5-MVybfwhZ.js

MediumDynamic Requiredist/assets/jsx-C97fCUqH.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowEvaldist/assets/src-BvIm_4jD.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/assets/src-BvIm_4jD.jsView file

Lines 113-135javascript

113 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

114 return result == null ? true : result;

115 }

117module.exports = exports.default;

119 (function () {

120 var enterModule = require('react-hot-loader').enterModule;

121 enterModule && enterModule(module);

123;(function () {

124 var reactHotLoader = require('react-hot-loader').default;

125 var leaveModule = require('react-hot-loader').leaveModule;

126 if (!reactHotLoader) {

127 return;

128 }

129${t.map(({variableName:e,uniqueLocalName:t})=>` reactHotLoader.register(${e}, "${t}", ${JSON.stringify(this.filePath||``)});`).join(`

130`)}

131 leaveModule(module);

133`);return i===-1&&(i=r.length,r+=`

135`,n=`\r`;e.LinesAndColumns=function(){function e(e){this.string=e;for(var r=[0],i=0;i<e.length;)switch(e[i]){case t:i+=t.length,r.push(i);break;case n:i+=

Long lines were clipped for display.

dist/assets/jsx-C97fCUqH.jsView file

Lines 1-1javascript

dist/assets/chunk-KEIR6QF5-MVybfwhZ.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/chunk-KEIR6QF5-MVybfwhZ.jsView on unpkg · L46