registry / @rtzh/gy-cesium / 0.0.12

@rtzh/gy-cesium@0.0.12

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystem

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 6.85 MB of source, external domains: wprd01.is.autonavi.com, www.w3.org

Oversized source lightweight scan

lib/v2/gy-cesium.es.js3.70 MB file, sampled 256 KB

UrlStringswww.w3.org

lib/v2.7/gy-cesium.es.js3.68 MB file, sampled 256 KB

HighEntropyStringsUrlStringswww.w3.org

lib/v3/gy-cesium.cjs.js2.75 MB file, sampled 256 KB

HighEntropyStringsMinified

lib/v3/gy-cesium.es.js

Source & flagged code

8 flagged

package.jsonView file

Lines 3-43json

3 "description": "gy",

4 "keywords": [

5 "@rtzh",

6 "gy",

7 "cesium",

8 "cesium components",

9 "Vue2",

10 "Vue3"

11 ],

12 "version": "0.0.12",

13 "license": "MIT",

14 "private": false,

15 "files": [

16 "lib",

17 "scripts",

18 "README.md"

19 ],

20 "main": "lib/gy-cesium.es.js",

21 "types": "lib/v3/index.d.ts",

22 "scripts": {

23 "postinstall": "node ./scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "dependencies": {

26 "@rtzh/engine": "^0.0.8",

27 "@rtzh/widgets": "^0.0.8",

28 "@rtzh/cesium": "^0.0.9",

29 "@turf/turf": "6.5.0",

30 "gsap": "3.12.2",

31 "vue-demi": "0.13.11"

32 },

33 "devDependencies": {

34 "vue": "^3.2.38"

35 },

36 "repository": {

37 "type": "git"

38 },

39 "peerDependencies": {

40 "@vue/composition-api": "^1.0.0-rc.1",

41 "vue": "^2.0.0 || >=3.0.0"

42 },

43 "peerDependenciesMeta": {

lib/v2.7/gy-cesium.cjs.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = */const ...=Mh;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/v2.7/gy-cesium.cjs.jsView on unpkg · L8

8patternName = supabase_service_key severity = critical line = 8 matchedText = */const ...=Mh;

Critical

Secret Pattern

Supabase service role key (JWT) in lib/v2.7/gy-cesium.cjs.js

lib/v2.7/gy-cesium.cjs.jsView on unpkg · L8

scripts/switch-cli.jsView file

Lines 1-17javascript

1const { switchVersion } = require('./utils')

2const version = process.argv[2]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/switch-cli.jsView on unpkg · L1

3console.log(

lib/v2.7/gy-cesium.es.jsView file

•path = lib/v2.7/gy-cesium.es.js kind = oversized_source_file sizeBytes = 3858001 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/v2.7/gy-cesium.es.jsView on unpkg

lib/v2/gy-cesium.umd.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = */functi...)});

Critical

Secret Pattern

Supabase service role key (JWT) in lib/v2/gy-cesium.umd.js

lib/v2/gy-cesium.umd.jsView on unpkg · L8

lib/v2/gy-cesium.cjs.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = */const ...=aA;

Critical

Secret Pattern

Supabase service role key (JWT) in lib/v2/gy-cesium.cjs.js

lib/v2/gy-cesium.cjs.jsView on unpkg · L8

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/v2.7/gy-cesium.cjs.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = */const ...=Mh;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/v2.7/gy-cesium.cjs.jsView on unpkg · L8

Findings

4 Critical2 High3 Medium5 Low

CriticalCritical Secretlib/v2.7/gy-cesium.cjs.js

CriticalSecret Patternlib/v2.7/gy-cesium.cjs.js

CriticalSecret Patternlib/v2/gy-cesium.umd.js

CriticalSecret Patternlib/v2/gy-cesium.cjs.js

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filelib/v2.7/gy-cesium.es.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/switch-cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

Low