registry  /  @servicetitan/anvil2  /  3.4.1

@servicetitan/anvil2@3.4.1

⚠ Under review

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVars
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 282 file(s), 5.15 MB of source, external domains: anvil.servicetitan.com, beta.anvil.servicetitan.com, bugs.chromium.org, data.iana.org, developer.microsoft.com, developer.mozilla.org, fb.me, github.com, motion.dev, prosemirror.net, w3c.github.io, www.servicetitan.com, www.stum.de, www.w3.org, www.youtube-nocookie.com, www.youtube.com

Source & flagged code

2 flagged · loading source
dist/RichTextEditor-D1IBYQyU.jsView file
2104contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/RichTextEditor-D1IBYQyU.jsView on unpkg · L2104
•Trigger-reachable chain: manifest.exports -> dist/beta.js -> dist/RichTextEditor-D1IBYQyU.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/RichTextEditor-D1IBYQyU.jsView on unpkg

Findings

2 Critical2 Medium4 Low
CriticalTrojan Source Unicodedist/RichTextEditor-D1IBYQyU.js
CriticalTrigger Reachable Dangerous Capabilitydist/RichTextEditor-D1IBYQyU.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License