registry  /  @ottocode/web-sdk  /  0.1.337

@ottocode/web-sdk@0.1.337

⚠ Under review

Reusable React components, hooks, and utilities for building ottocode web interfaces

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessNetworkWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 6 file(s), 4.10 MB of source, external domains: api.example.com, checkout.razorpay.com, example.com, github.com, mcp.linear.app, orbmarkets.io, share.ottocode.io, www.w3.org

Source & flagged code

3 flagged · loading source
dist/index.jsView file
15293contains invisible/control Unicode U+2066 (left-to-right isolate) children: `<U+2066>${displayText}<U+2069>`
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L15293
•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg
dist/assets/fonts/JetBrainsMonoNerdFontMono-Regular.woff2View file
•path = [redacted]-Regular.woff2 kind = high_entropy_blob sizeBytes = 1044196 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/fonts/JetBrainsMonoNerdFontMono-Regular.woff2View on unpkg

Findings

2 Critical1 High2 Medium4 Low
CriticalTrojan Source Unicodedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighShips High Entropy Blobdist/assets/fonts/JetBrainsMonoNerdFontMono-Regular.woff2
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings