registry / @rtzh/engine / 0.0.3

@rtzh/engine@0.0.3

CesiumJS is a JavaScript library for creating 3D globes and 2D maps in a web browser without a plugin.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,280 file(s), 12.5 MB of source, external domains: 29a.ch, api.bentley.com, api.cesium.com, api.mapbox.com, aras-p.info, archive.org, assets.ion.cesium.com, atlas.microsoft.com, bruop.github.io, bugs.chromium.org, casual-effects.blogspot.com, cbk0.google.com, cesium.com, content.gpwiki.org, dev.virtualearth.net, developer.download.nvidia.com, developer.nvidia.com, developers.arcgis.com, earth.google.com, get.webgl.org, github.com, google.github.io, graphics.stanford.edu, help.agi.com, ibasemaps-api.arcgis.com, jcgt.org, knarkowicz.wordpress.com, lolengine.net, maps.google.com, maps.googleapis.com, stackoverflow.com, tile.googleapis.com, tile.openstreetmap.org, www.cg.tuwien.ac.at, www.chilliant.com, www.cs.drexel.edu, www.cs.utah.edu, www.esri.com, www.fundza.com, www.gdcvault.com, www.google.com, www.jcgt.org, www.khronos.org, www.mapbox.com, www.mapinfo.com, www.microsoft.com, www.opengis.net, www.openstreetmap.org, www.ppsloan.org, www.topografix.com

Source & flagged code

5 flagged

Source/Core/Ion.jsView file

Lines 1-27javascript

1import Credit from "./Credit.js";

2import defined from "./defined.js";

3import Resource from "./Resource.js";

5let defaultTokenCredit;

6const defaultAccessToken =

7 "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiIxYTBmZmMzNy02NzcxLTRiMjUtYTllZS1hZmJjY2RkYjVhY2UiLCJpZCI6MjU5LCJpYXQiOjE3NjQ2MDU5OTB9.Nefln7pgRwDffoCJRJ8aaZn5iQzIPQrboLwKD2-ArDU";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Source/Core/Ion.jsView on unpkg · L7

Critical

Secret Pattern

Supabase service role key (JWT) in Source/Core/Ion.js

Source/Core/Ion.jsView on unpkg · L7

8/**

9 * Default settings for accessing the Cesium ion API.

10 *

11 * An ion access token is only required if you are using any ion related APIs.

12 * A default access token is provided for evaluation purposes only.

13 * Sign up for a free ion account and get your own access token at {@link https://cesium.com}

14 *

15 * @see IonResource

16 * @see IonImageryProvider

17 * @see IonGeocoderService

18 * @see createWorldImagery

19 * @see createWorldTerrain

20 * @namespace Ion

21 */

22const Ion = {};

24/**

25 * Gets or sets the default Cesium ion access token.

26 *

27 * @type {string}

Source/ThirdParty/Workers/basis_transcoder.jsView file

Lines 1-22javascript

2var BASIS = (function() {

3 var _scriptDir = typeof document !== 'undefined' && document.currentScript ? document.currentScript.src : undefined;

4 if (typeof __filename !==

Source/Workers/createGeometry.jsView file

Lines 1-39javascript

1import DeveloperError from "../Core/DeveloperError.js";

2import defined from "../Core/defined.js";

3import PrimitivePipeline from "../Scene/PrimitivePipeline.js";

4import createTaskProcessorWorker from "./createTaskProcessorWorker.js";

5/* global require */

7const

Source/ThirdParty/draco_decoder.wasmView file

•path = Source/ThirdParty/draco_decoder.wasm kind = wasm_module sizeBytes = 285948 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

Source/ThirdParty/draco_decoder.wasmView on unpkg

Source & flagged code

5 flagged · loading source

Source/Core/Ion.jsView file

7patternName = supabase_service_key severity = critical line = 7 matchedText = "eyJhbGc...DU";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Source/Core/Ion.jsView on unpkg · L7

7patternName = supabase_service_key severity = critical line = 7 matchedText = "eyJhbGc...DU";

Critical

Secret Pattern

Supabase service role key (JWT) in Source/Core/Ion.js

Source/Core/Ion.jsView on unpkg · L7

Source/ThirdParty/Workers/basis_transcoder.jsView file

8L9: var Module=typeof BASIS!=="undefined"?BASIS:{};var readyPromiseResolve,readyPromiseReject;Module["ready"]=new Promise(function(resolve,reject){readyPromiseResolve=resolve;readyProm... L10:

Low

Eval

Package source references a known benign dynamic code generation pattern.

Source/ThirdParty/Workers/basis_transcoder.jsView on unpkg · L8

Source/Workers/createGeometry.jsView file

19// Use CommonJS-style require. L20: module = require(modulePath); L21: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Source/Workers/createGeometry.jsView on unpkg · L19

Source/ThirdParty/draco_decoder.wasmView file

•path = Source/ThirdParty/draco_decoder.wasm kind = wasm_module sizeBytes = 285948 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

Source/ThirdParty/draco_decoder.wasmView on unpkg

Findings

2 Critical4 Medium5 Low

CriticalCritical SecretSource/Core/Ion.js

CriticalSecret PatternSource/Core/Ion.js

MediumDynamic RequireSource/Workers/createGeometry.js

MediumNetwork

MediumShips Wasm ModuleSource/ThirdParty/draco_decoder.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalSource/ThirdParty/Workers/basis_transcoder.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

Source/Core/Ion.jsView file

Lines 1-27javascript

1import Credit from "./Credit.js";

2import defined from "./defined.js";

3import Resource from "./Resource.js";

5let defaultTokenCredit;

6const defaultAccessToken =

7 "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiIxYTBmZmMzNy02NzcxLTRiMjUtYTllZS1hZmJjY2RkYjVhY2UiLCJpZCI6MjU5LCJpYXQiOjE3NjQ2MDU5OTB9.Nefln7pgRwDffoCJRJ8aaZn5iQzIPQrboLwKD2-ArDU";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Source/Core/Ion.jsView on unpkg · L7

Critical

Secret Pattern

Supabase service role key (JWT) in Source/Core/Ion.js

Source/Core/Ion.jsView on unpkg · L7

8/**

9 * Default settings for accessing the Cesium ion API.

10 *

11 * An ion access token is only required if you are using any ion related APIs.

12 * A default access token is provided for evaluation purposes only.

13 * Sign up for a free ion account and get your own access token at {@link https://cesium.com}

14 *

15 * @see IonResource

16 * @see IonImageryProvider

17 * @see IonGeocoderService

18 * @see createWorldImagery

19 * @see createWorldTerrain

20 * @namespace Ion

21 */

22const Ion = {};

24/**

25 * Gets or sets the default Cesium ion access token.

26 *

27 * @type {string}

Source/ThirdParty/Workers/basis_transcoder.jsView file

Lines 1-22javascript

2var BASIS = (function() {

3 var _scriptDir = typeof document !== 'undefined' && document.currentScript ? document.currentScript.src : undefined;

4 if (typeof __filename !==

Source/Workers/createGeometry.jsView file

Lines 1-39javascript

1import DeveloperError from "../Core/DeveloperError.js";

2import defined from "../Core/defined.js";

3import PrimitivePipeline from "../Scene/PrimitivePipeline.js";

4import createTaskProcessorWorker from "./createTaskProcessorWorker.js";

5/* global require */

7const

Source/ThirdParty/draco_decoder.wasmView file

•path = Source/ThirdParty/draco_decoder.wasm kind = wasm_module sizeBytes = 285948 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

Source/ThirdParty/draco_decoder.wasmView on unpkg