Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@qzsy/assistant-ui: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 13 finding(s) warrant review before installing.

View on npm All versions

registry / @qzsy/assistant-ui / 0.3.0

@qzsy/assistant-ui@0.3.0

Shuangyuan assistant-ui ? assistant-ui template pre-wired to @qzsy/sdk

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 66 file(s), 13.2 MB of source, external domains: api.cdnjs.com, api.github.com, cdn.jsdelivr.net, cdn.statically.io, cdnjs.cloudflare.com, exslt.org, gitcdn.xyz, github.com, rawcdn.githack.com, unpkg.com, www.apache.org, www.mathjax.org, www.w3.org

Oversized source lightweight scan

vendor/mathjax/tex-mml-svg.js2.02 MB file, sampled 256 KB

FilesystemChildProcess

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Eval

Minified

vendor/mathjax/tex-svg-full.js2.17 MB file, sampled 256 KB

ChildProcessEvalHighEntropyStringsMinified

vendor/mathjax/tex-svg.js2.01 MB file, sampled 256 KB

FilesystemChildProcessEvalMinified

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/build-css.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

vendor/mathjax/ui/menu.jsView file

1(function(){"use strict";var __webpack_modules__={706:function(e,t){Object.defineProperty(t,"__esModule",{value:!0});var n=new Map;t.default=n},8905:function(e,t,n){var r=this&&thi...

Low

Eval

Package source references a known benign dynamic code generation pattern.

vendor/mathjax/ui/menu.jsView on unpkg · L1

vendor/mathjax/input/asciimath.jsView file

1!function(){var t={306:function(t,e){"use strict";e.q=void 0,e.q="3.2.2"},884:function(t,e,i){"use strict";var n,a=this&&this.__extends||(n=function(t,e){return n=Object.setPrototy...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vendor/mathjax/input/asciimath.jsView on unpkg · L1

dist/assets/KaTeX_Typewriter-Regular.woff2View file

•path = dist/assets/KaTeX_Typewriter-Regular.woff2 kind = high_entropy_blob sizeBytes = 13568 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Typewriter-Regular.woff2View on unpkg

vendor/mathjax/tex-svg-full.jsView file

•path = vendor/mathjax/tex-svg-full.js kind = oversized_source_file sizeBytes = 2275113 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

vendor/mathjax/tex-svg-full.jsView on unpkg

Findings

3 High3 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdist/assets/KaTeX_Typewriter-Regular.woff2

HighOversized Source Filevendor/mathjax/tex-svg-full.js

MediumDynamic Requirevendor/mathjax/input/asciimath.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalvendor/mathjax/ui/menu.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Maintainershuanghuabin06, liuhuapiaoyuan1, curleaf

Version0.3.0

PublishedJul 20, 2026

Licensenone

Dependencies35

Integrityverified

Package size25.7 MB

Files173

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact43.3 MB · 173 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemHighEntropyStringsMinifiedObfuscatedUrlStringsNoLicense

LPM CLI

Source & flagged code

5 flagged

package.jsonView file

Lines 55-80json

55 "vite": "^8.1.5",

56 "zustand": "^5.0.14",

57 "@qzsy/sdk": "0.1.0"

58 },

59 "devDependencies": {

60 "@types/react": "^19.1.8",

61 "@types/react-dom": "^19.1.6",

62 "react": "^19.1.0",

63 "react-dom": "^19.1.0",

64 "rehype-sanitize": "^6.0.0",

65 "rehype-stringify": "^10.0.1",

66 "remark-parse": "^11.0.0",

67 "remark-rehype": "^11.1.2",

68 "tsup": "^8.4.0",

69 "typescript": "^5.8.3",

70 "unified": "^11.0.5",

71 "vitest": "^3.2.4"

72 },

73 "scripts": {

74 "build": "tsup && node scripts/build-css.mjs",

75 "postinstall": "node scripts/build-css.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L75

76 "dev": "tsup --watch",

77 "typecheck": "tsc --noEmit",

78 "test": "vitest run"

79 }

80}

vendor/mathjax/ui/menu.jsView file

Lines 1-1javascript

1(function(){"use strict";var __webpack_modules__={706:function(e,t){Object.defineProperty(t,"__esModule",{value:!0});var n=new Map;t.default=

vendor/mathjax/input/asciimath.jsView file

Lines 1-1javascript

1!function(){var t={306:function(t,e){"use strict";e.q=void 0,e.q="3.2.2"},884:function(t,

dist/assets/KaTeX_Typewriter-Regular.woff2View file

•path = dist/assets/KaTeX_Typewriter-Regular.woff2 kind = high_entropy_blob sizeBytes = 13568 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Typewriter-Regular.woff2View on unpkg

vendor/mathjax/tex-svg-full.jsView file

•path = vendor/mathjax/tex-svg-full.js kind = oversized_source_file sizeBytes = 2275113 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

vendor/mathjax/tex-svg-full.jsView on unpkg

n},

8905

:

function

(

e

,

t

,

n

){

var

r

=

this

&&

this

.__createBinding

||

(Object.create

?function

(

e

,

t

,

n

,

r

){

void

0

===

r

&&

(r

=

n);

var

o

=

Object.

getOwnPropertyDescriptor

(t,n);o

&&!

(

"get"

in

o

?!

t.__esModule

:

o.writable

||

o.configurable)

||

(o

=

{enumerable:

!

0

,

get

:

function

(){

return

t[n]}}),Object.

defineProperty

(e,r,o)}

:function

(

e

,

t

,

n

,

r

){

void

0

===

r

&&

(r

=

n),e[r]

=

t[n]}),o

=

this

&&

this

.__setModuleDefault

||

(Object.create

?function

(

e

,

t

){Object.

defineProperty

(e,

"default"

,{enumerable:

!

0

,value:t})}

:

f

...

Low

Eval

Package source references a known benign dynamic code generation pattern.

vendor/mathjax/ui/menu.jsView on unpkg · L1

Long lines were clipped for display.

e

,

i

){

"use strict"

;

var

n,a

=

this

&&

this

.__extends

||

(

n

=function

(

t

,

e

){

return

n

=

Object.setPrototypeOf

||

{__proto__:[]}

instanceof

Array

&&function

(

t

,

e

){t.

__proto__

=

e}

||function

(

t

,

e

){

for

(

var

i

in

e)

Object

.

prototype

.hasOwnProperty.

call

(e,i)

&&

(t[i]

=

e[i])},

n

(t,e)},

function

(

t

,

e

){

if

(

"function"

!=typeof

e

&&

null

!==

e)

throw

new

TypeError

(

"Class extends value "

+

String

(e)

+

" is not a constructor or null"

);

function

i

(){

this

.

constructor

=

t}

n

(t,e),

t

.

prototype

=

null

===

e

?

Object.

create

(e)

:

(

i

.

prototype

=

e

.

prototype

,

new

i)}),s

=

this

&&

this

._

...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vendor/mathjax/input/asciimath.jsView on unpkg · L1

Long lines were clipped for display.