Loading npm security reports…

@prozorro/prozorro-ui: Suspicious npm security report (Warn) | LPM Firewall

registry / @prozorro/prozorro-ui / 0.1.15

@prozorro/prozorro-ui@0.1.15

Official Prozorro UI Library

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 112 file(s), 5.22 MB of source, external domains: chromatic.com, fb.me, fonts.google.com, github.com, html.spec.whatwg.org, npms.io, prozorro.gov.ua, react.dev, reactjs.org, storybook.js.org, testing-library.com, testing-playground.com, unicode-org.github.io, vercel.com, vitest.dev, www.chromatic.com, www.netlify.com, www.w3.org

Oversized source lightweight scan

dist/app/sb-manager/globals-runtime.js3.03 MB file, sampled 256 KB

UrlStringsreactjs.orgwww.w3.org

Source & flagged code

5 flagged

dist/app/assets/iframe-C1X7ostz.jsView file

341patternName = generic_password severity = medium line = 341 matchedText = `+t),t},...r"?`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app/assets/iframe-C1X7ostz.jsView on unpkg · L341

1055* @license MIT L1056: **/const PT=Object.create(null);function Jee(e,t){if(!Oe(e))if(e.nodeType)e=e.innerHTML;else return Kt;const r=o4(e,t),n=PT[r];if(n)return n;if(e[0]==="#"){const a=document.querySe... L1057:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/app/assets/iframe-C1X7ostz.jsView on unpkg · L1055

dist/app/vite-inject-mocker-entry.jsView file

Lines 1-3javascript

1var we=Object.defineProperty;var ke=(e,r,t)=>r in e?we(e,r,{enumerable:!0,configurable:!0,writable:!0,value:t}):e[r]=t;var x=(e,r,t)=>ke(e,typeof r!="symbol"?r+"":r,t);import{_ as Se}from"./assets/preload-helper-C1FmrZbK.js";var ae=class{constructor(){x(this,"registryByUrl",new Map);x(this,"registryById",new Map)}clear(){this.registryByUrl.clear(),this.registryById.clear()}keys(){return this.registryByUrl.keys()}add(e){this.registryByUrl.set(e.url,e),this.registryById.set(e.id,e)}register(e,r,t,n,i){let a=typeof e=="object"?e.type:e;if(typeof e=="object"){let o=e;if(o instanceof X||o instanceo ...

2`),t=r.findIndex(i=>i.includes(` at Object.${e}`)||i.includes(`${e}@`)),n=at(r[t+1]);return(n==null?void 0

Long lines were clipped for display.

dist/favicon.icoView file

•path = dist/favicon.ico kind = high_entropy_blob sizeBytes = 44848 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon.icoView on unpkg

dist/app/sb-manager/globals-runtime.jsView file

•path = dist/app/sb-manager/globals-runtime.js kind = oversized_source_file sizeBytes = 3178601 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/app/sb-manager/globals-runtime.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/app/assets/iframe-C1X7ostz.jsView file

341patternName = generic_password severity = medium line = 341 matchedText = `+t),t},...r"?`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app/assets/iframe-C1X7ostz.jsView on unpkg · L341

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/app/assets/iframe-C1X7ostz.jsView on unpkg · L1055

dist/app/vite-inject-mocker-entry.jsView file

1var we=Object.defineProperty;var ke=(e,r,t)=>r in e?we(e,r,{enumerable:!0,configurable:!0,writable:!0,value:t}):e[r]=t;var x=(e,r,t)=>ke(e,typeof r!="symbol"?r+"":r,t);import{_ as ... L2: `),t=r.findIndex(i=>i.includes(` at Object.${e}`)||i.includes(`${e}@`)),n=at(r[t+1]);return(n==null?void 0:n.file)||""}var{now:se}=Date,ut=class{constructor(e,r,t,n){x(this,"regist...

Findings

2 High5 Medium5 Low

HighShips High Entropy Blobdist/favicon.ico

HighOversized Source Filedist/app/sb-manager/globals-runtime.js

MediumSecret Patterndist/app/assets/iframe-C1X7ostz.js

MediumDynamic Requiredist/app/vite-inject-mocker-entry.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/app/assets/iframe-C1X7ostz.js

LowHigh Entropy Strings

LowUrl Strings