@qlik/api@2.16.0

⚠ Under review

Exposes functions for interacting with Qlik apis

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 109 file(s), 1.12 MB of source, external domains: cdn.qlikcloud.com

Source & flagged code

1 flagged

oauth-callback.iife.jsView file

Lines 1150-1190javascript

1150 if (potentialMainJsUrl && window.__qlikMainPrivateResolvers.resolveMainJsUrl) {

1151 window.__qlikMainPrivateResolvers.forwardCompatibleHostConfig = hostConfig;

1152 window.__qlikMainPrivateResolvers.resolveMainJsUrl(potentialMainJsUrl);

1153 }

1154 }

1155 /**

1156 * Load a runtime module from the Qlik CDN

1157 * @param name the name of the module to load

1158 */

1159 async function importRuntimeModule(name, hostConfig) {

1160 if (hostConfig?.runtimeModuleMocks?.[name]) return hostConfig.runtimeModuleMocks?.[name];

1161 provideHostConfigForMainJsUrl(hostConfig);

1162 return importFromCdn(name);

1163 }

1164 /**

1165 * Load a module from Qlik

1166 * @param name the name of the module to load

1167 * @private

1168 */

1169 async function importFromCdn(name) {

1170 if (!window.__qlikMainPrivateResolvers?.qlikMainPromise) throw new Error("No main url resolver found");

1171 return (await window.__qlikMainPrivateResolvers.qlikMainPromise).import(name);

1172 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

oauth-callback.iife.jsView on unpkg · L1170

1173 async function handleWindowsAuthentication(url, hostConfig) {

1174 if (hostConfig?.authType === "windowscookie") {

1175 if (hostConfig.getAccessToken) {

1176 const token = await resolveTokenIfPresent(hostConfig.getAccessToken);

1177 if (token) await fetch(url, {

1178 method: "GET",

1179 mode: "cors",

1180 credentials: "include",

1181 headers: {

1182 "Content-Type": "application/json",

1183 Authorization: `Bearer ${token}`

1184 },

1185 cache: "no-cache"

1186 });

1187 return true;

1188 }

1189 if (hostConfig.loginUri) {

1190 if (!(await fetch(url, {

Source & flagged code

1 flagged · loading source

oauth-callback.iife.jsView file

1170if (!window.__qlikMainPrivateResolvers?.qlikMainPromise) throw new Error("No main url resolver found"); L1171: return (await window.__qlikMainPrivateResolvers.qlikMainPromise).import(name); L1172: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

oauth-callback.iife.jsView on unpkg · L1170

Findings

3 Medium3 Low

MediumDynamic Requireoauth-callback.iife.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @qlik/api@2.16.0.

See all versions of @qlik/api for other recorded verdicts.

Review the evidence and your use of @qlik/api@2.16.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 14:17:26.380Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @qlik

Related packages

More from @qlik

Source & flagged code