registry / @openc3/vue-common / 7.2.1

@openc3/vue-common@7.2.1

⚠ Under review

Vue component library for COSMOS tool development

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 240 file(s), 4.71 MB of source, external domains: ace.c9.io, api.github.com, docs.openc3.com, github.com, kubernetes.io, npms.io, openc3.com, pypi.org, raw.github.com, rubygems.org, store.openc3.com, www.w3.org

Source & flagged code

4 flagged

dist/ButtonWidget-DukCQt0F.jsView file

Lines 8-48javascript

8import { W as Widget } from "./Widget-CtYQauzA.js";

9const _sfc_main = {

10 components: {

11 CriticalCmdDialog

12 },

13 mixins: [Widget],

14 data() {

15 return {

16 api: null,

17 displaySendHazardous: !1,

18 lastCmd: "",

19 criticalCmdUuid: null,

20 criticalCmdString: null,

21 criticalCmdUser: null,

22 displayCriticalCmd: !1

23 };

24 },

25 computed: {

26 buttonText() {

27 return this.parameters[0];

28 },

29 eval() {

30 return this.parameters[1];

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ButtonWidget-DukCQt0F.jsView on unpkg · L28

31 }

32 },

33 created() {

34 this.api = new ho();

35 },

36 methods: {

37 async onClick() {

38 const lines = this.eval.split(";;"), self = this, screen = this.screen, screenValues = this.screenValues, screenTimeZone = this.screenTimeZone, api = this.api, runScript = this.runScript;

39 (self || screen || screenValues || screenTimeZone || api || runScript) && this.$nextTick(() => {

40 });

41 for (let i = 0; i < lines.length; i++)

42 try {

43 const result = eval(lines[i].trim());

44 result instanceof Promise && await result;

45 } catch (e) {

46 if (e.message.includes("CriticalCmdError"))

47 this.criticalCmdUuid = e.object.data.instance_variables["@uuid"], this.criticalCmdString = e.object.data.instance_variables["@cmd_string"], this.criticalCmdUser = e.object.data.instance_variables["@username"], this.displayCriticalCmd = !0;

48 else if (e.message.includes("is Hazardous"))

dist/InterfacesTab-DLu2fO_O.cjsView file

Lines 1-3javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("./format-DKACSABr.cjs");require("./UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-CZ6vWdLp.cjs");const e=require("vue"),p=require("./CustomIcon-8F08upeg.cjs");require("./store-CiS35N-w.cjs");

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView file

3079contains invisible/control Unicode U+202B (right-to-left embedding) le[le.length - 1] === b.DOT && (_e[le.length - 1] = b.B), le[0] === "<U+202B>" && (_e[0] = b.RLE);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView on unpkg · L3079

•Trigger-reachable chain: manifest.exports -> dist/components.js -> dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/ButtonWidget-DukCQt0F.jsView file

28}, L29: eval() { L30: return this.parameters[1];

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ButtonWidget-DukCQt0F.jsView on unpkg · L28

dist/InterfacesTab-DLu2fO_O.cjsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("./format-DKACSABr.cjs");require("./UpgradeToEnterpriseDialog.vue_vue_type_style_ind... L2: //# sourceMappingURL=InterfacesTab-DLu2fO_O.cjs.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/InterfacesTab-DLu2fO_O.cjsView on unpkg · L1

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView file

3079contains invisible/control Unicode U+202B (right-to-left embedding) le[le.length - 1] === b.DOT && (_e[le.length - 1] = b.B), le[0] === "<U+202B>" && (_e[0] = b.RLE);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView on unpkg · L3079

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView on unpkg

Findings

2 Critical5 Medium7 Low

CriticalTrojan Source Unicodedist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.js

CriticalTrigger Reachable Dangerous Capabilitydist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.js

MediumDynamic Requiredist/InterfacesTab-DLu2fO_O.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/ButtonWidget-DukCQt0F.js

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/ButtonWidget-DukCQt0F.jsView file

Lines 8-48javascript

8import { W as Widget } from "./Widget-CtYQauzA.js";

9const _sfc_main = {

10 components: {

11 CriticalCmdDialog

12 },

13 mixins: [Widget],

14 data() {

15 return {

16 api: null,

17 displaySendHazardous: !1,

18 lastCmd: "",

19 criticalCmdUuid: null,

20 criticalCmdString: null,

21 criticalCmdUser: null,

22 displayCriticalCmd: !1

23 };

24 },

25 computed: {

26 buttonText() {

27 return this.parameters[0];

28 },

29 eval() {

30 return this.parameters[1];

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ButtonWidget-DukCQt0F.jsView on unpkg · L28

31 }

32 },

33 created() {

34 this.api = new ho();

35 },

36 methods: {

37 async onClick() {

38 const lines = this.eval.split(";;"), self = this, screen = this.screen, screenValues = this.screenValues, screenTimeZone = this.screenTimeZone, api = this.api, runScript = this.runScript;

39 (self || screen || screenValues || screenTimeZone || api || runScript) && this.$nextTick(() => {

40 });

41 for (let i = 0; i < lines.length; i++)

42 try {

43 const result = eval(lines[i].trim());

44 result instanceof Promise && await result;

45 } catch (e) {

46 if (e.message.includes("CriticalCmdError"))

48 else if (e.message.includes("is Hazardous"))

dist/InterfacesTab-DLu2fO_O.cjsView file

Lines 1-3javascript

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView file

3079contains invisible/control Unicode U+202B (right-to-left embedding) le[le.length - 1] === b.DOT && (_e[le.length - 1] = b.B), le[0] === "<U+202B>" && (_e[0] = b.RLE);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView on unpkg · L3079

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/UpgradeToEnterpriseDialog.vue_vue_type_style_index_0_scoped_c790a82f_lang-Dh3Fnkgr.jsView on unpkg