registry / @rebilly/framepay-react / 13.142.1

@rebilly/framepay-react@13.142.1

A React wrapper for Rebilly's FramePay offering out-of-the-box support for Redux and other common React features

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 69 file(s), 305 KB of source, external domains: github.com, www.rebilly.com

Source & flagged code

3 flagged

tests/e2e/switch-react-version.jsView file

Lines 1-68javascript

1/**

2 * Tiny util to switch react version in test

3 *

4 * @type {string}

5 */

6const fs = require('fs');

7const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

tests/e2e/switch-react-version.jsView on unpkg · L6

9const version = process.env.REACT_VERSION;

10const clean = !version || version === 'clean';

12const packageJsonPath = './package.json';

13const backupPath = './package.json.backup';

14const lockfilePath = '../../../pnpm-lock.yaml';

15const lockfileBackupPath = '../../../pnpm-lock.yaml.backup';

17// Maps REACT_VERSION env values to the npm semver ranges to install.

18// React versions older than 16 are pinned exactly because they ship as

19// pre-release-style 0.x or first-major releases without patch families

20// we want to roll forward to.

21const versionMap = {

22 '0.14.0': {

23 react: '0.14.0',

24 'react-dom': '0.14.0',

25 'prop-types': '0.2.0',

26 jsxRuntime: 'classic',

28 '15.0.0': {

29 react: '15.0.0',

30 'react-dom': '15.0.0',

31 jsxRuntime: 'classic',

32 },

33 16: {

34 react: '^16',

35 'react-dom': '^16',

36 jsxRuntime: 'classic',

37 },

38 17: {

39 react: '^17',

40 'react-dom': '^17',

41 },

42 18: {

43 react: '^18',

44 'react-dom': '^18',

45 },

46};

48function runInstallCommand() {

49 execSync('pnpm install --no-frozen-lockfile', { stdio: 'inherit' });

50}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tests/e2e/switch-react-version.jsView on unpkg · L48

52function backupFiles() {

53 if (!fs.existsSync(backupPath)) {

54 fs.copyFileSync(packageJsonPath, backupPath);

55 console.log('>>> Backed up package.json <<<');

56 }

57 if (!fs.existsSync(lockfileBackupPath)) {

58 fs.copyFileSync(lockfilePath, lockfileBackupPath);

59 console.log('>>> Backed up pnpm-lock.yaml <<<');

60 }

61}

63function restoreFiles() {

64 if (fs.existsSync(backupPath)) {

65 fs.copyFileSync(backupPath, packageJsonPath);

66 fs.unlinkSync(backupPath);

67 console.log('>>> Restored package.json from backup <<<');

68 } else {

build/lib/dom-util.jsView file

Lines 19-59javascript

19 if (y = 0, t) op = [op[0] & 2, t.value];

20 switch (op[0]) {

21 case 0: case 1: t = op; break;

22 case 4: _.label++; return { value: op[1], done: false };

23 case 5: _.label++; y = op[1]; op = [0]; continue;

24 case 7: op = _.ops.pop(); _.trys.pop(); continue;

25 default:

26 if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }

27 if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }

28 if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }

29 if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }

30 if (t[2]) _.ops.pop();

31 _.trys.pop(); continue;

32 }

33 op = body.call(thisArg, _);

34 } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }

35 if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };

36 }

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.injectScript = void 0;

40var framepay_1 = require("@rebilly/framepay");

41var injectScript = function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

build/lib/dom-util.jsView on unpkg · L39

42 var _c;

43 var onReady = _b.onReady, onError = _b.onError;

44 return __generator(this, function (_d) {

45 switch (_d.label) {

46 case 0:

47 _d.trys.push([0, 2, , 3]);

48 return [4 /*yield*/, (0, framepay_1.loadFramepay)()];

49 case 1:

50 _d.sent();

51 onReady();

52 return [3 /*break*/, 3];

53 case 2:

54 _c = _d.sent();

55 onError();

56 return [3 /*break*/, 3];

57 case 3: return [2 /*return*/];

58 }

59 });

Source & flagged code

3 flagged · loading source

tests/e2e/switch-react-version.jsView file

6const fs = require('fs'); L7: const { execSync } = require('child_process'); L8:

High

Child Process

Package source references child process execution.

tests/e2e/switch-react-version.jsView on unpkg · L6

48function runInstallCommand() { L49: execSync('pnpm install --no-frozen-lockfile', { stdio: 'inherit' }); L50: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tests/e2e/switch-react-version.jsView on unpkg · L48

build/lib/dom-util.jsView file

39package = @rebilly/framepay-react; repositoryIdentity = rebilly; dependency = @rebilly/framepay L39: exports.injectScript = void 0; L40: var framepay_1 = require("@rebilly/framepay"); L41: var injectScript = function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

build/lib/dom-util.jsView on unpkg · L39

Findings

4 High3 Medium4 Low

HighChild Processtests/e2e/switch-react-version.js

HighShell

HighCopied Package Dependency Bridgebuild/lib/dom-util.js

HighRuntime Package Installtests/e2e/switch-react-version.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

tests/e2e/switch-react-version.jsView file

Lines 1-68javascript

1/**

2 * Tiny util to switch react version in test

3 *

4 * @type {string}

5 */

6const fs = require('fs');

7const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

tests/e2e/switch-react-version.jsView on unpkg · L6

9const version = process.env.REACT_VERSION;

10const clean = !version || version === 'clean';

12const packageJsonPath = './package.json';

13const backupPath = './package.json.backup';

14const lockfilePath = '../../../pnpm-lock.yaml';

15const lockfileBackupPath = '../../../pnpm-lock.yaml.backup';

17// Maps REACT_VERSION env values to the npm semver ranges to install.

18// React versions older than 16 are pinned exactly because they ship as

19// pre-release-style 0.x or first-major releases without patch families

20// we want to roll forward to.

21const versionMap = {

22 '0.14.0': {

23 react: '0.14.0',

24 'react-dom': '0.14.0',

25 'prop-types': '0.2.0',

26 jsxRuntime: 'classic',

28 '15.0.0': {

29 react: '15.0.0',

30 'react-dom': '15.0.0',

31 jsxRuntime: 'classic',

32 },

33 16: {

34 react: '^16',

35 'react-dom': '^16',

36 jsxRuntime: 'classic',

37 },

38 17: {

39 react: '^17',

40 'react-dom': '^17',

41 },

42 18: {

43 react: '^18',

44 'react-dom': '^18',

45 },

46};

48function runInstallCommand() {

49 execSync('pnpm install --no-frozen-lockfile', { stdio: 'inherit' });

50}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tests/e2e/switch-react-version.jsView on unpkg · L48

52function backupFiles() {

53 if (!fs.existsSync(backupPath)) {

54 fs.copyFileSync(packageJsonPath, backupPath);

55 console.log('>>> Backed up package.json <<<');

56 }

57 if (!fs.existsSync(lockfileBackupPath)) {

58 fs.copyFileSync(lockfilePath, lockfileBackupPath);

59 console.log('>>> Backed up pnpm-lock.yaml <<<');

60 }

61}

63function restoreFiles() {

64 if (fs.existsSync(backupPath)) {

65 fs.copyFileSync(backupPath, packageJsonPath);

66 fs.unlinkSync(backupPath);

67 console.log('>>> Restored package.json from backup <<<');

68 } else {

build/lib/dom-util.jsView file

Lines 19-59javascript

19 if (y = 0, t) op = [op[0] & 2, t.value];

20 switch (op[0]) {

21 case 0: case 1: t = op; break;

22 case 4: _.label++; return { value: op[1], done: false };

23 case 5: _.label++; y = op[1]; op = [0]; continue;

24 case 7: op = _.ops.pop(); _.trys.pop(); continue;

25 default:

26 if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }

27 if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }

28 if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }

29 if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }

30 if (t[2]) _.ops.pop();

31 _.trys.pop(); continue;

32 }

33 op = body.call(thisArg, _);

34 } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }

35 if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };

36 }

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.injectScript = void 0;

40var framepay_1 = require("@rebilly/framepay");

41var injectScript = function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

build/lib/dom-util.jsView on unpkg · L39

42 var _c;

43 var onReady = _b.onReady, onError = _b.onError;

44 return __generator(this, function (_d) {

45 switch (_d.label) {

46 case 0:

47 _d.trys.push([0, 2, , 3]);

48 return [4 /*yield*/, (0, framepay_1.loadFramepay)()];

49 case 1:

50 _d.sent();

51 onReady();

52 return [3 /*break*/, 3];

53 case 2:

54 _c = _d.sent();

55 onError();

56 return [3 /*break*/, 3];

57 case 3: return [2 /*return*/];

58 }

59 });