registry / @office-kit/xlsx / 0.9.0

@office-kit/xlsx@0.9.0

TypeScript library for reading and writing Excel xlsx files in Node and the browser.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 761 KB of source, external domains: purl.org, schemas.microsoft.com, schemas.openxmlformats.org, www.w3.org

Source & flagged code

1 flagged

dist/stylesheet-writer-P1Hxoqzm.mjsView file

Lines 6865-6905javascript

6865 const inner = [`<sortState${attrs}>`];

6866 for (const c of ss.conditions) inner.push(serializeSortCondition(c));

6867 inner.push("</sortState>");

6868 return inner.join("");

6869};

6870const serializeSortCondition = (c) => {

6871 let attrs = "";

6872 if (c.descending !== void 0) attrs += ` descending="${c.descending ? "1" : "0"}"`;

6873 if (c.sortBy !== void 0) attrs += ` sortBy="${c.sortBy}"`;

6874 attrs += ` ref="${escapeXmlAttr(c.ref)}"`;

6875 if (c.customList !== void 0) attrs += ` customList="${escapeXmlAttr(c.customList)}"`;

6876 if (c.dxfId !== void 0) attrs += ` dxfId="${c.dxfId}"`;

6877 if (c.iconSet !== void 0) attrs += ` iconSet="${c.iconSet}"`;

6878 if (c.iconId !== void 0) attrs += ` iconId="${c.iconId}"`;

6879 return `<sortCondition${attrs}/>`;

6880};

6881const serializeProtectedRanges = (ranges) => {

6882 const parts = ["<protectedRanges>"];

6883 for (const r of ranges) {

6884 let attrs = "";

6885 if (r.password !== void 0) attrs += ` password="${escapeXmlAttr(r.password)}"`;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/stylesheet-writer-P1Hxoqzm.mjsView on unpkg · L6885

6886 attrs += ` sqref="${escapeXmlAttr(multiCellRangeToString(r.sqref))}"`;

6887 attrs += ` name="${escapeXmlAttr(r.name)}"`;

6888 if (r.securityDescriptor !== void 0) attrs += ` securityDescriptor="${escapeXmlAttr(r.securityDescriptor)}"`;

6889 if (r.algorithmName !== void 0) attrs += ` algorithmName="${escapeXmlAttr(r.algorithmName)}"`;

6890 if (r.hashValue !== void 0) attrs += ` hashValue="${escapeXmlAttr(r.hashValue)}"`;

6891 if (r.saltValue !== void 0) attrs += ` saltValue="${escapeXmlAttr(r.saltValue)}"`;

6892 if (r.spinCount !== void 0) attrs += ` spinCount="${r.spinCount}"`;

6893 parts.push(`<protectedRange${attrs}/>`);

6894 }

6895 parts.push("</protectedRanges>");

6896 return parts.join("");

6897};

6898const serializeScenarioList = (sl) => {

6899 if (sl.scenarios.length === 0 && sl.current === void 0 && sl.show === void 0 && sl.sqref === void 0) return;

6900 let attrs = "";

6901 if (sl.current !== void 0) attrs += ` current="${sl.current}"`;

6902 if (sl.show !== void 0) attrs += ` show="${sl.show}"`;

6903 if (sl.sqref !== void 0) attrs += ` sqref="${escapeXmlAttr(multiCellRangeToString(sl.sqref))}"`;

6904 if (sl.scenarios.length === 0) return `<scenarios${attrs}/>`;

6905 const inner = [];

Source & flagged code

1 flagged · loading source

dist/stylesheet-writer-P1Hxoqzm.mjsView file

6885patternName = generic_password severity = medium line = 6885 matchedText = if (r.pa...}"`;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/stylesheet-writer-P1Hxoqzm.mjsView on unpkg · L6885

Findings

1 Medium5 Low

MediumSecret Patterndist/stylesheet-writer-P1Hxoqzm.mjs

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/stylesheet-writer-P1Hxoqzm.mjsView file

Lines 6865-6905javascript

6865 const inner = [`<sortState${attrs}>`];

6866 for (const c of ss.conditions) inner.push(serializeSortCondition(c));

6867 inner.push("</sortState>");

6868 return inner.join("");

6869};

6870const serializeSortCondition = (c) => {

6871 let attrs = "";

6872 if (c.descending !== void 0) attrs += ` descending="${c.descending ? "1" : "0"}"`;

6873 if (c.sortBy !== void 0) attrs += ` sortBy="${c.sortBy}"`;

6874 attrs += ` ref="${escapeXmlAttr(c.ref)}"`;

6875 if (c.customList !== void 0) attrs += ` customList="${escapeXmlAttr(c.customList)}"`;

6876 if (c.dxfId !== void 0) attrs += ` dxfId="${c.dxfId}"`;

6877 if (c.iconSet !== void 0) attrs += ` iconSet="${c.iconSet}"`;

6878 if (c.iconId !== void 0) attrs += ` iconId="${c.iconId}"`;

6879 return `<sortCondition${attrs}/>`;

6880};

6881const serializeProtectedRanges = (ranges) => {

6882 const parts = ["<protectedRanges>"];

6883 for (const r of ranges) {

6884 let attrs = "";

6885 if (r.password !== void 0) attrs += ` password="${escapeXmlAttr(r.password)}"`;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/stylesheet-writer-P1Hxoqzm.mjsView on unpkg · L6885

6886 attrs += ` sqref="${escapeXmlAttr(multiCellRangeToString(r.sqref))}"`;

6887 attrs += ` name="${escapeXmlAttr(r.name)}"`;

6888 if (r.securityDescriptor !== void 0) attrs += ` securityDescriptor="${escapeXmlAttr(r.securityDescriptor)}"`;

6889 if (r.algorithmName !== void 0) attrs += ` algorithmName="${escapeXmlAttr(r.algorithmName)}"`;

6890 if (r.hashValue !== void 0) attrs += ` hashValue="${escapeXmlAttr(r.hashValue)}"`;

6891 if (r.saltValue !== void 0) attrs += ` saltValue="${escapeXmlAttr(r.saltValue)}"`;

6892 if (r.spinCount !== void 0) attrs += ` spinCount="${r.spinCount}"`;

6893 parts.push(`<protectedRange${attrs}/>`);

6894 }

6895 parts.push("</protectedRanges>");

6896 return parts.join("");

6897};

6898const serializeScenarioList = (sl) => {

6899 if (sl.scenarios.length === 0 && sl.current === void 0 && sl.show === void 0 && sl.sqref === void 0) return;

6900 let attrs = "";

6901 if (sl.current !== void 0) attrs += ` current="${sl.current}"`;

6902 if (sl.show !== void 0) attrs += ` show="${sl.show}"`;

6903 if (sl.sqref !== void 0) attrs += ` sqref="${escapeXmlAttr(multiCellRangeToString(sl.sqref))}"`;

6904 if (sl.scenarios.length === 0) return `<scenarios${attrs}/>`;

6905 const inner = [];