registry / @quicktvui/web-cli / 3.2.11

@quicktvui/web-cli@3.2.11

CLI tool for QuickTVUI web development v3 - delegate build & bundle loading

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 1007 KB of source, external domains: stuk.github.io, www.w3.org

Source & flagged code

4 flagged

runtime/web-runtime.f8d6dcf304070d9ce014.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Package contains a possible secret pattern.

runtime/web-runtime.f8d6dcf304070d9ce014.jsView on unpkg · L2

1/*! For license information please see web-runtime.f8d6dcf304070d9ce014.js.LICENSE.txt */ L2: (()=>{var e,t,n,r,i={8576(e,t){"use strict";t.byteLength=function(e){var t=s(e),n=t[0],r=t[1];return 3*(n+r)/4-r},t.toByteArray=function(e){var t,n,o=s(e),a=o[0],u=o[1],l=new i(fun...

Low

Eval

Package source references a known benign dynamic code generation pattern.

runtime/web-runtime.f8d6dcf304070d9ce014.jsView on unpkg · L1

bin/qt-web-cli.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * QuickTVUI Web CLI v2

5 *

6 * v2 架构：委托构建 + Bundle 加载模式

7 * - 调用项目的 dev 脚本构建

8 * - 监听 dist/dev 目录

9 * - 启动轻量静态服务器加载 dist/dev 的 bundle

10 *

11 * v1 回退：当项目没有 dev 脚本时，使用原有的 webpack 自构建模式

12 */

14const path = require('path')

15const fs = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/qt-web-cli.jsView on unpkg · L13

16const signale = require('signale')

17const minimist = require('minimist')

18const { exec } = require('shelljs')

20// 解析命令行参数

21const args = minimist(process.argv.slice(2), {

22 string: ['port', 'config', 'devScript', 'distDir'],

23 boolean: ['help', 'open', 'v', 'info', 'version', 'watch', 'noAutoBuild', 'v1'],

24 alias: {

25 p: 'port',

26 c: 'config',

27 h: 'help',

28 o: 'open',

29 w: 'watch',

30 },

31 default: {

32 port: 39001,

33 open: process.env.QUICKTVUI_NO_OPEN !== 'true',

runtime/wasm_crypto_bg.wasmView file

•path = runtime/wasm_crypto_bg.wasm kind = wasm_module sizeBytes = 64091 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

runtime/wasm_crypto_bg.wasmView on unpkg

Source & flagged code

4 flagged · loading source

runtime/web-runtime.f8d6dcf304070d9ce014.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Package contains a possible secret pattern.

runtime/web-runtime.f8d6dcf304070d9ce014.jsView on unpkg · L2

Low

Eval

Package source references a known benign dynamic code generation pattern.

runtime/web-runtime.f8d6dcf304070d9ce014.jsView on unpkg · L1

bin/qt-web-cli.jsView file

13L14: const path = require('path') L15: const fs = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/qt-web-cli.jsView on unpkg · L13

runtime/wasm_crypto_bg.wasmView file

•path = runtime/wasm_crypto_bg.wasm kind = wasm_module sizeBytes = 64091 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

runtime/wasm_crypto_bg.wasmView on unpkg

Findings

6 Medium6 Low

MediumSecret Patternruntime/web-runtime.f8d6dcf304070d9ce014.js

MediumDynamic Requirebin/qt-web-cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduleruntime/wasm_crypto_bg.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalruntime/web-runtime.f8d6dcf304070d9ce014.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

runtime/web-runtime.f8d6dcf304070d9ce014.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Package contains a possible secret pattern.

runtime/web-runtime.f8d6dcf304070d9ce014.jsView on unpkg · L2

Low

Eval

Package source references a known benign dynamic code generation pattern.

runtime/web-runtime.f8d6dcf304070d9ce014.jsView on unpkg · L1

bin/qt-web-cli.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * QuickTVUI Web CLI v2

5 *

6 * v2 架构：委托构建 + Bundle 加载模式

7 * - 调用项目的 dev 脚本构建

8 * - 监听 dist/dev 目录

9 * - 启动轻量静态服务器加载 dist/dev 的 bundle

10 *

11 * v1 回退：当项目没有 dev 脚本时，使用原有的 webpack 自构建模式

12 */

14const path = require('path')

15const fs = require('fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/qt-web-cli.jsView on unpkg · L13

16const signale = require('signale')

17const minimist = require('minimist')

18const { exec } = require('shelljs')

20// 解析命令行参数

21const args = minimist(process.argv.slice(2), {

22 string: ['port', 'config', 'devScript', 'distDir'],

23 boolean: ['help', 'open', 'v', 'info', 'version', 'watch', 'noAutoBuild', 'v1'],

24 alias: {

25 p: 'port',

26 c: 'config',

27 h: 'help',

28 o: 'open',

29 w: 'watch',

30 },

31 default: {

32 port: 39001,

33 open: process.env.QUICKTVUI_NO_OPEN !== 'true',

runtime/wasm_crypto_bg.wasmView file

•path = runtime/wasm_crypto_bg.wasm kind = wasm_module sizeBytes = 64091 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

runtime/wasm_crypto_bg.wasmView on unpkg