@polotno/pdf-export@0.2.17: Suspicious npm security report (Warn)

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 2.07 MB of source, external domains: feross.org, github.com, ns.adobe.com, purl.org, tools.ietf.org, www.aiim.org, www.w3.org

Source & flagged code

3 flagged

lib/index.jsView file

177js: import "konva/skia-backend"; L178: `,Nc=()=>{if(typeof document>"u")throw new Error(Pp)},Le=class e{constructor(x=[1,0,0,1,0,0]){this.dirty=!1,this.m=x&&x.slice()||[1,0,0,1,0,0]}reset(){this.m[0]=1,this.m[1]=0,this.... L179: p, ul, ol { margin: 0; padding: 0; }

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L177

177js: import "konva/skia-backend"; L178: `,Nc=()=>{if(typeof document>"u")throw new Error(Pp)},Le=class e{constructor(x=[1,0,0,1,0,0]){this.dirty=!1,this.m=x&&x.slice()||[1,0,0,1,0,0]}reset(){this.m[0]=1,this.m[1]=0,this.... L179: p, ul, ol { margin: 0; padding: 0; }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L177

2const require = __pdfExportCreateRequire(import.meta.url); L3: var pd=Object.create;var Ur=Object.defineProperty;var gd=Object.getOwnPropertyDescriptor;var md=Object.getOwnPropertyNames;var yd=Object.getPrototypeOf,wd=Object.prototype.hasOwnPr... L4: `),new x0("",M3,""),new x0("",_0,"]"),new x0("",_0," for "),new x0("",U3,""),new x0("",I3,""),new x0("",_0," a "),new x0("",_0," that "),new x0(" ",Sx,""),new x0("",_0,". "),new x0... ... L14: `){o.words.length===0?(o.lineHeight=L,o.endedByHardBreak=!0,s.push(o),o={words:[],totalWidth:0,lineHeight:0}):(o.endedByHardBreak=!0,u()),g=!0;continue}if(f){o.words.push(S),o.tota... L15: `)break;let U=!!O.text&&s5.test(O.text),B=!O.text&&!!O.boxClose,H=!!O.text&&!!O.noBreakBefore;if(U||B||H){b+=O.width;continue}break}for(let F of y){let U=F===y[y.length-1]?b:0,B=!F... L16: `)}_compareKeys(){throw new Error("Must be implemented by subclasses")}_keysName(){throw new Error("Must be implemented by subclasses")}_dataForKey(){throw new Error("Must be imple... ... L18: `,"binary")),this.uncompressedLength+=x.length,this.data.Length==null&&(this.data.Length=0),this.buffer.push(x),this.data.Length+=x.length,this.compress&&(this.data.Filter="FlateDe.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/index.jsView on unpkg · L2

Source & flagged code

3 flagged · loading source

lib/index.jsView file

177js: import "konva/skia-backend"; L178: `,Nc=()=>{if(typeof document>"u")throw new Error(Pp)},Le=class e{constructor(x=[1,0,0,1,0,0]){this.dirty=!1,this.m=x&&x.slice()||[1,0,0,1,0,0]}reset(){this.m[0]=1,this.m[1]=0,this.... L179: p, ul, ol { margin: 0; padding: 0; }

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L177

177js: import "konva/skia-backend"; L178: `,Nc=()=>{if(typeof document>"u")throw new Error(Pp)},Le=class e{constructor(x=[1,0,0,1,0,0]){this.dirty=!1,this.m=x&&x.slice()||[1,0,0,1,0,0]}reset(){this.m[0]=1,this.m[1]=0,this.... L179: p, ul, ol { margin: 0; padding: 0; }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L177

2const require = __pdfExportCreateRequire(import.meta.url); L3: var pd=Object.create;var Ur=Object.defineProperty;var gd=Object.getOwnPropertyDescriptor;var md=Object.getOwnPropertyNames;var yd=Object.getPrototypeOf,wd=Object.prototype.hasOwnPr... L4: `),new x0("",M3,""),new x0("",_0,"]"),new x0("",_0," for "),new x0("",U3,""),new x0("",I3,""),new x0("",_0," a "),new x0("",_0," that "),new x0(" ",Sx,""),new x0("",_0,". "),new x0... ... L14: `){o.words.length===0?(o.lineHeight=L,o.endedByHardBreak=!0,s.push(o),o={words:[],totalWidth:0,lineHeight:0}):(o.endedByHardBreak=!0,u()),g=!0;continue}if(f){o.words.push(S),o.tota... L15: `)break;let U=!!O.text&&s5.test(O.text),B=!O.text&&!!O.boxClose,H=!!O.text&&!!O.noBreakBefore;if(U||B||H){b+=O.width;continue}break}for(let F of y){let U=F===y[y.length-1]?b:0,B=!F... L16: `)}_compareKeys(){throw new Error("Must be implemented by subclasses")}_keysName(){throw new Error("Must be implemented by subclasses")}_dataForKey(){throw new Error("Must be imple... ... L18: `,"binary")),this.uncompressedLength+=x.length,this.data.Length==null&&(this.data.Length=0),this.buffer.push(x),this.data.Length+=x.length,this.compress&&(this.data.Filter="FlateDe.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/index.jsView on unpkg · L2

Findings

3 High3 Medium6 Low

HighChild Processlib/index.js

HighSame File Env Network Executionlib/index.js

HighObfuscated

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License