registry / @qefro-ai/widget / 1.1.5

@qefro-ai/widget@1.1.5

Embeddable AI chat widget for Qefro customer support

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

NetworkWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 5 file(s), 606 KB of source, external domains: api.qefro.com, wa.me, www.w3.org

Source & flagged code

1 flagged

dist/widget.iife.jsView file

Lines 1-21javascript

1(function(Pe){"use strict";const ct="KGZ1bmN0aW9uKCl7InVzZSBzdHJpY3QiO2xldCBvLGk7Y29uc3QgYT1jbGFzcyBhe3N0YXRpYyBhc3luYyBnZXRJbnN0YW5jZShlKXtpZighbyl7Y29uc3Qgcj1hd2FpdCBpbXBvcnQoImh0dHBzOi8vY2RuLmpzZGVsaXZyLm5ldC9ucG0vQGh1Z2dpbmdmYWNlL3RyYW5zZm9ybWVyc0A0LjIuMCIpO289ci5waXBlbGluZSxpPXIuZW52LGkuYWxsb3dMb2NhbE1vZGVscz0hMX1yZXR1cm4gdGhpcy5pbnN0YW5jZT09PW51bGwmJih0aGlzLmluc3RhbmNlPWF3YWl0IG8odGhpcy50YXNrLHRoaXMubW9kZWwse3Byb2dyZXNzX2NhbGxiYWNrOmUsZHR5cGU6e2VuY29kZXJfbW9kZWw6InE0IixkZWNvZGVyX21vZGVsX21lcmdlZDoicTQifX0pKSx0aGlzLmluc3RhbmNlfX07YS50YXNrPSJhdXRvbWF0aWMtc3BlZWNoLXJlY29nbml0aW9uIixhLm1vZGV ...

2In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ki(a,e){return vi(a)||Si(a,e)||Ai(a,e)||Ti()}function Ai(a,e){if(a){if(typeof a=="string")return gt(a,e);var t={}.toString.call(a).slice(8,-1);return t==="Object"&&a.constructor&&(t=a.constructor.name),t==="Map"||t==="Set"?Array.from(a):t==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t)?gt(a,e):void 0}}const ft=Object.entries,mt=Object.setPrototypeOf,Ii=Object.isFrozen,Ei=Object.getPrototypeOf,Ci=Object.getOwnPropertyDescriptor;let P=Object.freeze,U=Object.seal,oe=Object.create,bt=typ ...

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/widget.iife.jsView on unpkg · L1

3`+x),ee&&V([Ie,Ee,Ce],E=>{x=le(x,E," ")}),L&&Me?de(x):x},e.setConfig=function(){let c=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};ot(c),Ze

4 #ai-widget-container {

5 --ai-primary: ${e};

6 --ai-primary-dark: color-mix(in srgb, ${e} 85%, black);

7 --ai-bg: ${a.theme==="dark"?"rgba(30, 30, 46, 0.92)":"rgba(255, 255, 255, 0.92)"};

8 --ai-bg-secondary: ${a.theme==="dark"?"rgba(42, 42, 62, 0.5)":"rgba(245, 245, 247, 0.7)"};

9 --ai-text: ${a.theme==="dark"?"#e4e4e7":"#18181b"};

10 --ai-text-secondary: ${a.theme==="dark"?"#a1a1aa":"#71717a"};

11 --ai-border: ${a.theme==="dark"?"rgba(255, 255, 255, 0.08)":"rgba(0, 0, 0, 0.08)"};

12 position: fixed;

13 z-index: 999999;

14 font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;

15 }

17 #ai-widget-container.bottom-right {

18 bottom: 20px;

19 bottom: calc(env(safe-area-inset-bottom) + 20px);

20 right: 20px;

21 right: calc(env(safe-area-inset-right) + 20px);

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/widget.iife.jsView file

1(function(Pe){"use strict";const ct="[redacted]... L2: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ki(a,e){return vi(a)||Si(a,e)||Ai(a,e)||Ti()}function Ai(a,e){if(a){if(typeof a=="stri...

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/widget.iife.jsView on unpkg · L1

Findings

1 High1 Medium6 Low

HighBase64 Obscured Urldist/widget.iife.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

dist/widget.iife.jsView file

Lines 1-21javascript

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/widget.iife.jsView on unpkg · L1

3`+x),ee&&V([Ie,Ee,Ce],E=>{x=le(x,E," ")}),L&&Me?de(x):x},e.setConfig=function(){let c=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};ot(c),Ze

4 #ai-widget-container {

5 --ai-primary: ${e};

6 --ai-primary-dark: color-mix(in srgb, ${e} 85%, black);

7 --ai-bg: ${a.theme==="dark"?"rgba(30, 30, 46, 0.92)":"rgba(255, 255, 255, 0.92)"};

8 --ai-bg-secondary: ${a.theme==="dark"?"rgba(42, 42, 62, 0.5)":"rgba(245, 245, 247, 0.7)"};

9 --ai-text: ${a.theme==="dark"?"#e4e4e7":"#18181b"};

10 --ai-text-secondary: ${a.theme==="dark"?"#a1a1aa":"#71717a"};

11 --ai-border: ${a.theme==="dark"?"rgba(255, 255, 255, 0.08)":"rgba(0, 0, 0, 0.08)"};

12 position: fixed;

13 z-index: 999999;

14 font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;

15 }

17 #ai-widget-container.bottom-right {

18 bottom: 20px;

19 bottom: calc(env(safe-area-inset-bottom) + 20px);

20 right: 20px;

21 right: calc(env(safe-area-inset-right) + 20px);

Long lines were clipped for display.