registry / @orangelogic/design-system / 2.123.0

@orangelogic/design-system@2.123.0

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 274 file(s), 11.6 MB of source, external domains: aka.ms, cortex.orangelogic.com, datatracker.ietf.org, design-system.orangelogic.com, developer.mozilla.org, docs.oasis-open.org, dom.spec.whatwg.org, downloads.orangelogic.com, dpdb.webvr.rocks, drafts.csswg.org, echarts.apache.org, en.wikipedia.org, example.com, fontawesome.io, git.io, github.com, gsap.com, html.spec.whatwg.org, learn.microsoft.com, local.orangelogic.com, markerjs.com, openoffice.org, purl.oclc.org, purl.org, react.dev, reactjs.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, sheetjs.openxmlformats.org, tools.ietf.org, vjs.zencdn.net, webvr.info, www.amcharts.com, www.google.com, www.iana.org, www.w3.org

Oversized source lightweight scan

library/chunks/document-viewer.VVTf0dxG.js2.38 MB file, sampled 256 KB

NetworkEvalHighEntropyStringsUrlStringsgithub.comwww.w3.org

library/chunks/pdfmake.Bs7cMDH0.js2.33 MB file, sampled 256 KB

FilesystemChildProcessEvalShellHighEntropyStrings

library/components/types.js6.73 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsUrlStringsdownloads.orangelogic.comwww.w3.org

Source & flagged code

4 flagged

library/chunks/i18n.NAH4U8Lw.jsView file

Lines 793-833javascript

793 orderedList: "Ordered list",

794 outdent: "Outdent",

795 overflow: "Overflow",

796 overflowBehavior: "Overflow behavior",

797 overlay: "Overlay",

798 padding: "Padding",

799 paddingBottom: "Padding Bottom",

800 paddingLeft: "Padding Left",

801 paddingRight: "Padding Right",

802 paddingTop: "Padding Top",

803 paddings: "Paddings",

804 page: "Page",

805 pageTitle: "Page title",

806 pagination: "Pagination",

807 palette: "Palette",

808 panelTitle: "Panel title",

809 pantoneMatchingSystemName: "Pantone matching system name",

810 paragraph: "Paragraph",

811 paragraphSpacing: "Paragraph spacing",

812 parameters: "Parameters",

813 password: "Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

library/chunks/i18n.NAH4U8Lw.jsView on unpkg · L813

814 passwordEmpty: "Password Empty",

815 paste: "Paste",

816 pasteAsPlainText: "Paste as text",

817 pause: "Pause",

818 pauseAll: "Pause All",

819 pauseTime: "Pause Time",

820 paused: "Paused",

821 pendingChangesSaveReminder: "Pending changes must be saved to export",

822 pin: "Pin",

823 pinFirstCard: "Pin first card",

824 pinFirstCardHelpText: "Makes the first card double size. Only applies if 2 or more rows",

825 pins: "Pins",

826 pitchWithUnit: (e) => e ? `Pitch (${e})` : "Pitch",

827 pixels: "Pixels",

828 placeholder: "Placeholder",

829 play: "Play",

830 pleaseEnterAValidUrl: "Please enter a valid URL.",

831 pleaseSelectAnAsset: "Please select an asset",

832 popOut: "Pop-out",

833 position: "Position",

library/components/e-chart.jsView file

24348function KH(r) { L24349: return X(r) ? typeof JSON < "u" && JSON.parse ? JSON.parse(r) : new Function("return (" + r + ");")() : r; L24350: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

library/components/e-chart.jsView on unpkg · L24348

library/chunks/exporting.B3VErmmW.jsView file

Lines 1-26javascript

1import { E as F, a7 as V, z as O, _ as f, e as S, a8 as H, a9 as z, aa as D, a as W, ab as N, f as U, ac as x, ad as I, ae as J, M as q, s as G, c as w, g as K, af as j, ag

library/chunks/document-viewer.VVTf0dxG.jsView file

•path = library/chunks/document-viewer.VVTf0dxG.js kind = oversized_source_file sizeBytes = 2496591 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

library/chunks/document-viewer.VVTf0dxG.jsView on unpkg

Source & flagged code

4 flagged · loading source

library/chunks/i18n.NAH4U8Lw.jsView file

813patternName = generic_password severity = medium line = 813 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

library/chunks/i18n.NAH4U8Lw.jsView on unpkg · L813

library/components/e-chart.jsView file

24348function KH(r) { L24349: return X(r) ? typeof JSON < "u" && JSON.parse ? JSON.parse(r) : new Function("return (" + r + ");")() : r; L24350: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

library/components/e-chart.jsView on unpkg · L24348

library/chunks/exporting.B3VErmmW.jsView file

6let h = yield Promise.all([ L7: import( L8: /* webpackChunkName: "pdfmake" */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

library/chunks/exporting.B3VErmmW.jsView on unpkg · L6

library/chunks/document-viewer.VVTf0dxG.jsView file

•path = library/chunks/document-viewer.VVTf0dxG.js kind = oversized_source_file sizeBytes = 2496591 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

library/chunks/document-viewer.VVTf0dxG.jsView on unpkg

Findings

1 High5 Medium7 Low

HighOversized Source Filelibrary/chunks/document-viewer.VVTf0dxG.js

MediumSecret Patternlibrary/chunks/i18n.NAH4U8Lw.js

MediumDynamic Requirelibrary/chunks/exporting.B3VErmmW.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvallibrary/components/e-chart.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

library/chunks/i18n.NAH4U8Lw.jsView file

Lines 793-833javascript

793 orderedList: "Ordered list",

794 outdent: "Outdent",

795 overflow: "Overflow",

796 overflowBehavior: "Overflow behavior",

797 overlay: "Overlay",

798 padding: "Padding",

799 paddingBottom: "Padding Bottom",

800 paddingLeft: "Padding Left",

801 paddingRight: "Padding Right",

802 paddingTop: "Padding Top",

803 paddings: "Paddings",

804 page: "Page",

805 pageTitle: "Page title",

806 pagination: "Pagination",

807 palette: "Palette",

808 panelTitle: "Panel title",

809 pantoneMatchingSystemName: "Pantone matching system name",

810 paragraph: "Paragraph",

811 paragraphSpacing: "Paragraph spacing",

812 parameters: "Parameters",

813 password: "Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

library/chunks/i18n.NAH4U8Lw.jsView on unpkg · L813

814 passwordEmpty: "Password Empty",

815 paste: "Paste",

816 pasteAsPlainText: "Paste as text",

817 pause: "Pause",

818 pauseAll: "Pause All",

819 pauseTime: "Pause Time",

820 paused: "Paused",

821 pendingChangesSaveReminder: "Pending changes must be saved to export",

822 pin: "Pin",

823 pinFirstCard: "Pin first card",

824 pinFirstCardHelpText: "Makes the first card double size. Only applies if 2 or more rows",

825 pins: "Pins",

826 pitchWithUnit: (e) => e ? `Pitch (${e})` : "Pitch",

827 pixels: "Pixels",

828 placeholder: "Placeholder",

829 play: "Play",

830 pleaseEnterAValidUrl: "Please enter a valid URL.",

831 pleaseSelectAnAsset: "Please select an asset",

832 popOut: "Pop-out",

833 position: "Position",

library/components/e-chart.jsView file

24348function KH(r) { L24349: return X(r) ? typeof JSON < "u" && JSON.parse ? JSON.parse(r) : new Function("return (" + r + ");")() : r; L24350: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

library/components/e-chart.jsView on unpkg · L24348

library/chunks/exporting.B3VErmmW.jsView file

Lines 1-26javascript

1import { E as F, a7 as V, z as O, _ as f, e as S, a8 as H, a9 as z, aa as D, a as W, ab as N, f as U, ac as x, ad as I, ae as J, M as q, s as G, c as w, g as K, af as j, ag

library/chunks/document-viewer.VVTf0dxG.jsView file

•path = library/chunks/document-viewer.VVTf0dxG.js kind = oversized_source_file sizeBytes = 2496591 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

library/chunks/document-viewer.VVTf0dxG.jsView on unpkg