registry / @rtzh/gy-cesium / 0.0.16

@rtzh/gy-cesium@0.0.16

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystem

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 6.85 MB of source, external domains: wprd01.is.autonavi.com, www.w3.org

Oversized source lightweight scan

lib/v2/gy-cesium.es.js3.71 MB file, sampled 256 KB

HighEntropyStringsUrlStringswww.w3.org

lib/v2.7/gy-cesium.es.js3.68 MB file, sampled 256 KB

UrlStringswww.w3.org

lib/v3/gy-cesium.cjs.js2.75 MB file, sampled 256 KB

HighEntropyStringsMinified

lib/v3/gy-cesium.es.js

Source & flagged code

9 flagged

package.jsonView file

Lines 3-43json

3 "description": "gy",

4 "keywords": [

5 "@rtzh",

6 "gy",

7 "cesium",

8 "cesium components",

9 "Vue2",

10 "Vue3"

11 ],

12 "version": "0.0.16",

13 "license": "MIT",

14 "private": false,

15 "files": [

16 "lib",

17 "scripts",

18 "README.md"

19 ],

20 "main": "lib/gy-cesium.es.js",

21 "types": "lib/v3/index.d.ts",

22 "scripts": {

23 "postinstall": "node ./scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "dependencies": {

26 "@rtzh/cesium": "^0.0.11",

27 "@rtzh/engine": "^0.0.10",

28 "@rtzh/widgets": "^0.0.10",

29 "@turf/turf": "6.5.0",

30 "gsap": "3.12.2",

31 "vue-demi": "0.13.11"

32 },

33 "devDependencies": {

34 "vue": "^3.2.38"

35 },

36 "repository": {

37 "type": "git"

38 },

39 "peerDependencies": {

40 "@vue/composition-api": "^1.0.0-rc.1",

41 "vue": "^2.0.0 || >=3.0.0"

42 },

43 "peerDependenciesMeta": {

lib/v2.7/gy-cesium.cjs.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = */functi...=qh;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/v2.7/gy-cesium.cjs.jsView on unpkg · L8

8patternName = supabase_service_key severity = critical line = 8 matchedText = */functi...=qh;

Critical

Secret Pattern

Supabase service role key (JWT) in lib/v2.7/gy-cesium.cjs.js

lib/v2.7/gy-cesium.cjs.jsView on unpkg · L8

•matchType = previous_version_dangerous_delta matchedPackage = @rtzh/gy-cesium@0.0.14 matchedIdentity = npm:QHJ0emgvZ3ktY2VzaXVt:0.0.14 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/v2.7/gy-cesium.cjs.jsView on unpkg

scripts/switch-cli.jsView file

Lines 1-17javascript

1const { switchVersion } = require('./utils')

2const version = process.argv[2]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/switch-cli.jsView on unpkg · L1

3console.log(

lib/v2.7/gy-cesium.es.jsView file

•path = lib/v2.7/gy-cesium.es.js kind = oversized_source_file sizeBytes = 3861575 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/v2.7/gy-cesium.es.jsView on unpkg

lib/v2/gy-cesium.umd.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = */functi...)});

Critical

Secret Pattern

Supabase service role key (JWT) in lib/v2/gy-cesium.umd.js

lib/v2/gy-cesium.umd.jsView on unpkg · L8

lib/v2/gy-cesium.cjs.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = */const ...=iA;

Critical

Secret Pattern

Supabase service role key (JWT) in lib/v2/gy-cesium.cjs.js

lib/v2/gy-cesium.cjs.jsView on unpkg · L8

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/v2.7/gy-cesium.cjs.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = */functi...=qh;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/v2.7/gy-cesium.cjs.jsView on unpkg · L8

Findings

4 Critical3 High3 Medium5 Low

CriticalCritical Secretlib/v2.7/gy-cesium.cjs.js

CriticalSecret Patternlib/v2.7/gy-cesium.cjs.js

CriticalSecret Patternlib/v2/gy-cesium.umd.js

CriticalSecret Patternlib/v2/gy-cesium.cjs.js

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filelib/v2.7/gy-cesium.es.js

HighPrevious Version Dangerous Deltalib/v2.7/gy-cesium.cjs.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/switch-cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings