registry / @ramathibodi/nuxt-commons / 4.0.17

@ramathibodi/nuxt-commons@4.0.17

Ramathibodi Nuxt modules for common components

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShellWebSocket

Supply chain

HighEntropyStrings

Manifest

WildcardDependency

scanned 131 file(s), 424 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 26-85json

26 "default": "./dist/runtime/composables/*/*.js"

27 },

28 "./components/*": "./dist/runtime/components/*.vue",

29 "./components/*/*": "./dist/runtime/components/*/*.vue",

30 "./lab/*": "./dist/runtime/labs/*.vue",

31 "./lab/*/*": "./dist/runtime/labs/*/*.vue"

32 },

33 "main": "./dist/module.mjs",

34 "typesVersions": {

35 "*": {

36 ".": [

37 "./dist/types.d.mts"

38 ]

39 }

40 },

41 "files": [

42 "dist",

43 "scripts",

44 "templates"

45 ],

46 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L46

47 "prepack": "nuxt-module-build build",

48 "dev": "npm run dev:prepare && nuxt dev playground",

49 "dev:build": "nuxt build playground",

50 "dev:generate": "nuxt generate playground",

51 "playground:scaffold": "node scripts/scaffold-playground-pages.mjs",

52 "template:validate": "node scripts/validate-document-template.mjs",

53 "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxt prepare playground",

54 "docs:api:components": "vue-docgen -c docs/vue-docgen.config.cjs && npm run docs:ai:summary && node scripts/enrich-vue-docs-from-ai.mjs",

55 "docs:api:composables": "typedoc --options docs/typedoc.json",

56 "docs:api:composables:md": "npm run docs:ai:summary && node scripts/generate-composables-md.mjs",

57 "docs:api": "npm run docs:api:components && npm run docs:api:composables",

58 "docs:ai:summary": "node scripts/generate-ai-summary.mjs",

59 "release": "npm run lint && npm run test && npm run prepack && node scripts/release.mjs",

60 "lint": "eslint .",

61 "lint:fix": "eslint . --fix",

62 "test": "vitest run",

63 "test:watch": "vitest watch",

64 "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",

65 "postinstall": "node scripts/postInstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

66 },

67 "peerDependencies": {

68 "nuxt": "^4.3.1"

69 },

70 "dependencies": {

71 "@codemirror/lang-html": "^6.4.11",

72 "@codemirror/lang-javascript": "^6.2.5",

73 "@codemirror/lang-vue": "^0.1.3",

74 "@codemirror/theme-one-dark": "^6.1.3",

75 "@fortawesome/fontawesome-free": "^6.7.2",

76 "@fullcalendar/core": "^6.1.20",

77 "@fullcalendar/daygrid": "^6.1.20",

78 "@fullcalendar/interaction": "^6.1.20",

79 "@fullcalendar/list": "^6.1.20",

80 "@fullcalendar/multimonth": "^6.1.20",

81 "@fullcalendar/timegrid": "^6.1.20",

82 "@fullcalendar/vue3": "^6.1.20",

83 "@graphql-codegen/add": "^5.0.3",

84 "@graphql-codegen/cli": "^6.1.3",

85 "@graphql-codegen/plugin-helpers": "^6.1.1",

dist/runtime/composables/document/template.jsView file

Lines 1-26javascript

1import { processTemplateFormTable } from "./templateFormTable.js";

2import { processTemplateFormTableData } from "./templateFormTableData.js";

3import { processTemplateFormHidden } from "./templateFormHidden.js";

4import { some, includes, cloneDeep } from "lodash-es";

5import { migrateInputAttributes, migrateTemplateString } from

templates/public/tesseract/mrz.traineddata.gzView file

•path = templates/public/tesseract/mrz.traineddata.gz kind = high_entropy_blob sizeBytes = 10922829 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/public/tesseract/mrz.traineddata.gzView on unpkg

•path = templates/public/tesseract/mrz.traineddata.gz kind = compressed_blob sizeBytes = 10922829 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/public/tesseract/mrz.traineddata.gzView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postInstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

dist/runtime/composables/document/template.jsView file

6import { [redacted] } from "./templateInputTypes.js"; L7: export const validationRulesRegex = /^(require(?:\([^)]*\))?|requireIf\([^)]*\)|requireTrue(?:\([^)]*\))?|requireTrueIf\([^)]*\)|requireNotEmpty(?:\([^)]*\))?|numeric(?:\([^)]*\))?... L8: export function useDocumentTemplate(items, parentTemplates) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/composables/document/template.jsView on unpkg · L6

templates/public/tesseract/mrz.traineddata.gzView file

•path = templates/public/tesseract/mrz.traineddata.gz kind = high_entropy_blob sizeBytes = 10922829 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/public/tesseract/mrz.traineddata.gzView on unpkg

•path = templates/public/tesseract/mrz.traineddata.gz kind = compressed_blob sizeBytes = 10922829 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/public/tesseract/mrz.traineddata.gzView on unpkg

Findings

2 High6 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobtemplates/public/tesseract/mrz.traineddata.gz

MediumDynamic Requiredist/runtime/composables/document/template.js

MediumEnvironment Vars

MediumShips Compressed Blobtemplates/public/tesseract/mrz.traineddata.gz

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings