@polotno/pdf-export@0.4.0: Suspicious npm security report (Warn)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.90 MB of source, external domains: feross.org, github.com, konvajs.org, ns.adobe.com, purl.org, tools.ietf.org, www.aiim.org, www.w3.org

Source & flagged code

4 flagged

lib/index.jsView file

154`)},endMetadata(){this._addInfo(),this.metadata.end(),this.version!=1.3&&(this.metadataRef=this.ref({length:this.metadata.getLength(),Type:"Metadata",Subtype:"XML"}),this.metadataR... L155: `,"binary")),this.push(x),this._offset+=x.length}addContent(x){return this.page.write(x),this}_refEnd(x){this._offsets[x.id-1]=x.offset,--this._waiting===0&&this._ended&&(this._fin... L156:

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L154

154`)},endMetadata(){this._addInfo(),this.metadata.end(),this.version!=1.3&&(this.metadataRef=this.ref({length:this.metadata.getLength(),Type:"Metadata",Subtype:"XML"}),this.metadataR... L155: `,"binary")),this.push(x),this._offset+=x.length}addContent(x){return this.page.write(x),this}_refEnd(x){this._offsets[x.id-1]=x.offset,--this._waiting===0&&this._ended&&(this._fin... L156: ... L167: js: import "konva/skia-backend"; L168: `,zo=()=>{if(typeof document>"u")throw new Error(zu)},Se=class t{constructor(x=[1,0,0,1,0,0]){this.dirty=!1,this.m=x&&x.slice()||[1,0,0,1,0,0]}reset(){this.m[0]=1,this.m[1]=0,this.... L169: p, ul, ol { margin: 0; padding: 0; }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L154

153</rdf:Description> L154: `)},endMetadata(){this._addInfo(),this.metadata.end(),this.version!=1.3&&(this.metadataRef=this.ref({length:this.metadata.getLength(),Type:"Metadata",Subtype:"XML"}),this.metadataR... L155: `,"binary")),this.push(x),this._offset+=x.length}addContent(x){return this.page.write(x),this}_refEnd(x){this._offsets[x.id-1]=x.offset,--this._waiting===0&&this._ended&&(this._fin... L156: ... L167: js: import "konva/skia-backend"; L168: `,zo=()=>{if(typeof document>"u")throw new Error(zu)},Se=class t{constructor(x=[1,0,0,1,0,0]){this.dirty=!1,this.m=x&&x.slice()||[1,0,0,1,0,0]}reset(){this.m[0]=1,this.m[1]=0,this.... L169: p, ul, ol { margin: 0; padding: 0; }

Source & flagged code

4 flagged · loading source

lib/index.jsView file

154`)},endMetadata(){this._addInfo(),this.metadata.end(),this.version!=1.3&&(this.metadataRef=this.ref({length:this.metadata.getLength(),Type:"Metadata",Subtype:"XML"}),this.metadataR... L155: `,"binary")),this.push(x),this._offset+=x.length}addContent(x){return this.page.write(x),this}_refEnd(x){this._offsets[x.id-1]=x.offset,--this._waiting===0&&this._ended&&(this._fin... L156:

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L154

154`)},endMetadata(){this._addInfo(),this.metadata.end(),this.version!=1.3&&(this.metadataRef=this.ref({length:this.metadata.getLength(),Type:"Metadata",Subtype:"XML"}),this.metadataR... L155: `,"binary")),this.push(x),this._offset+=x.length}addContent(x){return this.page.write(x),this}_refEnd(x){this._offsets[x.id-1]=x.offset,--this._waiting===0&&this._ended&&(this._fin... L156: ... L167: js: import "konva/skia-backend"; L168: `,zo=()=>{if(typeof document>"u")throw new Error(zu)},Se=class t{constructor(x=[1,0,0,1,0,0]){this.dirty=!1,this.m=x&&x.slice()||[1,0,0,1,0,0]}reset(){this.m[0]=1,this.m[1]=0,this.... L169: p, ul, ol { margin: 0; padding: 0; }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L154

153</rdf:Description> L154: `)},endMetadata(){this._addInfo(),this.metadata.end(),this.version!=1.3&&(this.metadataRef=this.ref({length:this.metadata.getLength(),Type:"Metadata",Subtype:"XML"}),this.metadataR... L155: `,"binary")),this.push(x),this._offset+=x.length}addContent(x){return this.page.write(x),this}_refEnd(x){this._offsets[x.id-1]=x.offset,--this._waiting===0&&this._ended&&(this._fin... L156: ... L167: js: import "konva/skia-backend"; L168: `,zo=()=>{if(typeof document>"u")throw new Error(zu)},Se=class t{constructor(x=[1,0,0,1,0,0]){this.dirty=!1,this.m=x&&x.slice()||[1,0,0,1,0,0]}reset(){this.m[0]=1,this.m[1]=0,this.... L169: p, ul, ol { margin: 0; padding: 0; }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/index.jsView on unpkg · L153

2const require = __pdfExportCreateRequire(import.meta.url); L3: var _5=Object.create;var ri=Object.defineProperty;var S5=Object.getOwnPropertyDescriptor;var A5=Object.getOwnPropertyNames;var P5=Object.getPrototypeOf,k5=Object.prototype.hasOwnPr... L4: `),new Z("",Nd,""),new Z("",l0,"]"),new Z("",l0," for "),new Z("",Xd,""),new Z("",Ud,""),new Z("",l0," a "),new Z("",l0," that "),new Z(" ",sx,""),new Z("",l0,". "),new Z(".",l0,""... L5: `),new Z("",l0,":"),new Z(" ",l0,". "),new Z("",l0,"ed "),new Z("",Jd,""),new Z("",Zd,""),new Z("",Hd,""),new Z("",l0,"("),new Z("",sx,", "),new Z("",Wd,""),new Z("",l0," at "),new... L6: `)}_compareKeys(){throw new Error("Must be implemented by subclasses")}_keysName(){throw new Error("Must be implemented by subclasses")}_dataForKey(){throw new Error("Must be imple... ... L8: `,"binary")),this.uncompressedLength+=x.length,this.data.Length==null&&(this.data.Length=0),this.buffer.push(x),this.data.Length+=x.length,this.compress&&(this.data.Filter="FlateDe... L9: endstream`)),this.document._write("endobj"),this.document._refEnd(this)}toString(){return`${this.id} ${this.gen} R`}},en=new Float32Array(1),lo=new Uint32Array(en.buffer);function ... L10:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/index.jsView on unpkg · L2

Findings

4 High3 Medium6 Low

HighChild Processlib/index.js

HighSame File Env Network Executionlib/index.js

HighCommand Output Exfiltrationlib/index.js

HighObfuscated

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License