registry / @servicetitan/anvil2 / 3.17.0

@servicetitan/anvil2@3.17.0

⚠ Under review

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 281 file(s), 5.60 MB of source, external domains: anvil.servicetitan.com, beta.anvil.servicetitan.com, developer.mozilla.org, fb.me, github.com, motion.dev, prosemirror.net, www.servicetitan.com, www.w3.org, www.youtube-nocookie.com, www.youtube.com

Source & flagged code

2 flagged

dist/react-CG1BUt2y.jsView file

Lines 8704-8744javascript

8704 * to dynamically generate CSS. They both use the `@emotion/is-prop-valid` package to determine which

8705 * of these should be passed to the underlying DOM node.

8706 *

8707 * However, when styling a Motion component `styled(motion.div)`, both packages pass through *all* props

8708 * as it's seen as an arbitrary component rather than a DOM node. Motion only allows arbitrary props

8709 * passed through the `custom` prop so it doesn't *need* the payload or computational overhead of

8710 * `@emotion/is-prop-valid`, however to fix this problem we need to use it.

8711 *

8712 * By making it an optionalDependency we can offer this functionality only in the situations where it's

8713 * actually required.

8714 */

8715try {

8716 /**

8717 * We attempt to import this package but require won't be defined in esm environments, in that case

8718 * isPropValid will have to be provided via `MotionContext`. In a 6.0.0 this should probably be removed

8719 * in favour of explicit injection.

8720 *

8721 * String concatenation prevents bundlers like webpack (e.g. Storybook)

8722 * from statically resolving this optional dependency at build time.

8723 */

8724 const emotionPkg = "@emotion/is-prop-" + "valid";

8725 loadExternalIsValidProp(require(emotionPkg).default);

8726}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/react-CG1BUt2y.jsView on unpkg · L8724

8727catch {

8728 // We don't need to actually do anything here - the fallback is the existing `isPropValid`.

8729}

8730function filterProps(props, isDom, forwardMotionProps) {

8731 const filteredProps = {};

8732 for (const key in props) {

8733 /**

8734 * values is considered a valid prop by Emotion, so if it's present

8735 * this will be rendered out to the DOM unless explicitly filtered.

8736 *

8737 * We check the type as it could be used with the `feColorMatrix`

8738 * element, which we support.

8739 */

8740 if (key === "values" && typeof props.values === "object")

8741 continue;

8742 if (isMotionValue(props[key]))

8743 continue;

8744 if (shouldForward(key) ||

dist/AiMark.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 82

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/AiMark.cssView on unpkg

Source & flagged code

2 flagged · loading source

dist/react-CG1BUt2y.jsView file

8724const emotionPkg = "@emotion/is-prop-" + "valid"; L8725: loadExternalIsValidProp(require(emotionPkg).default); L8726: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/react-CG1BUt2y.jsView on unpkg · L8724

dist/AiMark.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 82

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/AiMark.cssView on unpkg

Findings

1 High3 Medium4 Low

HighSemantic Analysis Limiteddist/AiMark.css

MediumDynamic Requiredist/react-CG1BUt2y.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @servicetitan/anvil2@3.17.0.

See all versions of @servicetitan/anvil2 for other recorded verdicts.

Review the evidence and your use of @servicetitan/anvil2@3.17.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 22:21:04.552Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @servicetitan

Related packages

More from @servicetitan

Source & flagged code