registry  /  @quicktvui/web-cli  /  3.4.1

@quicktvui/web-cli@3.4.1

CLI tool for QuickTVUI web development v3 - delegate build & bundle loading

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 13 file(s), 1.05 MB of source, external domains: stuk.github.io, www.w3.org

Source & flagged code

5 flagged · loading source
runtime/web-runtime.c7c2d37fcf84d0edee44.jsView file
2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();
Medium
Secret Pattern

Package contains a possible secret pattern.

runtime/web-runtime.c7c2d37fcf84d0edee44.jsView on unpkg · L2
1/*! For license information please see web-runtime.c7c2d37fcf84d0edee44.js.LICENSE.txt */ L2: (()=>{var e,t,n,r,i={8576(e,t){"use strict";t.byteLength=function(e){var t=s(e),n=t[0],r=t[1];return 3*(n+r)/4-r},t.toByteArray=function(e){var t,n,o=s(e),a=o[0],u=o[1],l=new i(fun...
Low
Eval

Package source references a known benign dynamic code generation pattern.

runtime/web-runtime.c7c2d37fcf84d0edee44.jsView on unpkg · L1
bin/qt-web-cli.jsView file
13L14: const path = require('path') L15: const fs = require('fs')
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/qt-web-cli.jsView on unpkg · L13
runtime/wasm_crypto_bg.wasmView file
•path = runtime/wasm_crypto_bg.wasm kind = wasm_module sizeBytes = 64091 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

runtime/wasm_crypto_bg.wasmView on unpkg
lib/DevServer.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @quicktvui/web-cli@3.3.0 matchedIdentity = npm:QHF1aWNrdHZ1aS93ZWItY2xp:3.3.0 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/DevServer.jsView on unpkg

Findings

1 High6 Medium6 Low
HighPrevious Version Dangerous Deltalib/DevServer.js
MediumSecret Patternruntime/web-runtime.c7c2d37fcf84d0edee44.js
MediumDynamic Requirebin/qt-web-cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleruntime/wasm_crypto_bg.wasm
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalruntime/web-runtime.c7c2d37fcf84d0edee44.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings