@rainbow-robotics/muscat-plugin-kit: Suspicious npm security

Loading npm security reports…

Source & flagged code

9 flagged

cli/storybook-dist/assets/index-C1OzuK6-.jsView file

227patternName = generic_password severity = medium line = 227 matchedText = `+t),t},...{r}"

Medium

Secret Pattern

Package contains a possible secret pattern.

cli/storybook-dist/assets/index-C1OzuK6-.jsView on unpkg · L227

cli/storybook-dist/sb-manager/globals-runtime.jsView file

8464var l = parseInt("" + s[1], 10), u = parseInt("" + s[2], 10) / 100, c = parseInt("" + s[3], 10) / 100, p = "rgb(" + kp(l, u, c) + ")", h = _y. L8465: exec(p); L8466: if (!h)

High

Child Process

Package source references child process execution.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L8464

26849if (e !== "Object") { L26850: let t = new Function(`return function ${e.replace(/[^a-zA-Z0-9$_]+/g, "")}(){}`)(); L26851: Object.setPrototypeOf(value, new t());

Low

Eval

Package source references a known benign dynamic code generation pattern.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L26849

cli/src/uninstall.mjsView file

Lines 17-57javascript

18function isNpmGlobalInstall() {

19 try {

20 return isInside(realpathSync(kitRoot), realpathSync(npmGlobalRoot()));

21 } catch {

cli/storybook-dist/sb-addons/essentials-controls-2/manager-bundle.jsView file

Lines 1-21javascript

1try{

2(()=>{var kp=Object.create;var Un=Object.defineProperty;var Rp=Object.getOwnPropertyDescriptor;var Op=Object.getOwnPropertyNames;var _p=

cli/src/update.mjsView file

Lines 1-26javascript

1// muscat-pk update — update the CLI itself AND the plugin project's JS deps.

2//

3// Three install modes are handled:

4// binary : Bun self-contained binary downloaded from S3

5// → re-download from S3, replace process.execPath

6// npm -g : globally installed Node.js package

7// → npm install -g @rainbow-robotics/muscat-plugin-kit@<tag>

8// local : plugin project's node_modules (fallback)

9// → <pm> add @rainbow-robotics/muscat-plugin-kit@<tag>

10//

cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.pyView file

•path = cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.py kind = build_helper sizeBytes = 0

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.pyView on unpkg

cli/storybook-dist/nunito-sans-bold-italic.woff2View file

•path = cli/storybook-dist/nunito-sans-bold-italic.woff2 kind = high_entropy_blob sizeBytes = 49460 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/storybook-dist/nunito-sans-bold-italic.woff2View on unpkg

cli/storybook-dist/assets/createGoalLayer-BTJsygfA.jsView file

•path = cli/storybook-dist/assets/createGoalLayer-BTJsygfA.js kind = oversized_source_file sizeBytes = 2730249 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/storybook-dist/assets/createGoalLayer-BTJsygfA.jsView on unpkg

Source & flagged code

9 flagged · loading source

cli/storybook-dist/assets/index-C1OzuK6-.jsView file

227patternName = generic_password severity = medium line = 227 matchedText = `+t),t},...{r}"

Medium

Secret Pattern

Package contains a possible secret pattern.

cli/storybook-dist/assets/index-C1OzuK6-.jsView on unpkg · L227

cli/storybook-dist/sb-manager/globals-runtime.jsView file

8464var l = parseInt("" + s[1], 10), u = parseInt("" + s[2], 10) / 100, c = parseInt("" + s[3], 10) / 100, p = "rgb(" + kp(l, u, c) + ")", h = _y. L8465: exec(p); L8466: if (!h)

High

Child Process

Package source references child process execution.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L8464

26849if (e !== "Object") { L26850: let t = new Function(`return function ${e.replace(/[^a-zA-Z0-9$_]+/g, "")}(){}`)(); L26851: Object.setPrototypeOf(value, new t());

@rainbow-robotics/muscat-plugin-kit: Suspicious npm security | LPM Firewall

Source & flagged code

9 flagged

cli/storybook-dist/assets/index-C1OzuK6-.jsView file

227patternName = generic_password severity = medium line = 227 matchedText = `+t),t},...{r}"

Medium

Secret Pattern

Package contains a possible secret pattern.

cli/storybook-dist/assets/index-C1OzuK6-.jsView on unpkg · L227

cli/storybook-dist/sb-manager/globals-runtime.jsView file

8464var l = parseInt("" + s[1], 10), u = parseInt("" + s[2], 10) / 100, c = parseInt("" + s[3], 10) / 100, p = "rgb(" + kp(l, u, c) + ")", h = _y. L8465: exec(p); L8466: if (!h)

High

Child Process

Package source references child process execution.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L8464

26849if (e !== "Object") { L26850: let t = new Function(`return function ${e.replace(/[^a-zA-Z0-9$_]+/g, "")}(){}`)(); L26851: Object.setPrototypeOf(value, new t());

Low

Eval

Package source references a known benign dynamic code generation pattern.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L26849

cli/src/uninstall.mjsView file

Lines 17-57javascript

18function isNpmGlobalInstall() {

19 try {

20 return isInside(realpathSync(kitRoot), realpathSync(npmGlobalRoot()));

21 } catch {

cli/storybook-dist/sb-addons/essentials-controls-2/manager-bundle.jsView file

Lines 1-21javascript

1try{

2(()=>{var kp=Object.create;var Un=Object.defineProperty;var Rp=Object.getOwnPropertyDescriptor;var Op=Object.getOwnPropertyNames;var _p=

cli/src/update.mjsView file

Lines 1-26javascript

1// muscat-pk update — update the CLI itself AND the plugin project's JS deps.

2//

3// Three install modes are handled:

4// binary : Bun self-contained binary downloaded from S3

5// → re-download from S3, replace process.execPath

6// npm -g : globally installed Node.js package

7// → npm install -g @rainbow-robotics/muscat-plugin-kit@<tag>

8// local : plugin project's node_modules (fallback)

9// → <pm> add @rainbow-robotics/muscat-plugin-kit@<tag>

10//

cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.pyView file

•path = cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.py kind = build_helper sizeBytes = 0

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.pyView on unpkg

cli/storybook-dist/nunito-sans-bold-italic.woff2View file

•path = cli/storybook-dist/nunito-sans-bold-italic.woff2 kind = high_entropy_blob sizeBytes = 49460 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/storybook-dist/nunito-sans-bold-italic.woff2View on unpkg

cli/storybook-dist/assets/createGoalLayer-BTJsygfA.jsView file

•path = cli/storybook-dist/assets/createGoalLayer-BTJsygfA.js kind = oversized_source_file sizeBytes = 2730249 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/storybook-dist/assets/createGoalLayer-BTJsygfA.jsView on unpkg

@rainbow-robotics/muscat-plugin-kit@1.0.4

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code