Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@sim-design/training@1.1.1: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 13 finding(s) warrant review before installing.

View on npm All versions

registry / @sim-design/training / 1.1.1

@sim-design/training@1.1.1

实训教学平台组件库。把「运行训练模型 / 创建模型 / 编辑模型」三类能力以 React 组件形式提供给外部宿主工程集成。

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 126 file(s), 16.8 MB of source, external domains: 47.104.204.111, api.coze.cn, babeljs.io, bit.ly, developer.mozilla.org, echarts.apache.org, fonts.googleapis.com, github.com, html.spec.whatwg.org, jedwatson.github.io, lea.verou.me, motion.dev, nodejs.org, opensource.org, reactjs.org, redux-toolkit.js.org, redux.js.org, www.w3.org

Oversized source lightweight scan

dist/DialogueFormPlugin-8yKT46xw.js4.48 MB file, sampled 256 KB

Network

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

ChildProcess

HighEntropyStrings

UrlStrings

babeljs.io

fonts.googleapis.com

github.com

lea.verou.me

opensource.org

dist/DialogueFormPlugin-i9kP3Ehk.js4.48 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsUrlStringsbabeljs.iofonts.googleapis.comgithub.comlea.verou.meopensource.org

dist/DialogueFormPlugin-kKxKdJKH.js4.48 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsUrlStringsbabeljs.iofonts.googleapis.comgithub.comlea.verou.meopensource.org

dist/assets/DialogueFormPlugin-CJjDylsj.js3.21 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringsbabeljs.iofonts.googleapis.comgithub.com

dist/assets/index-CGae3Rb3.js2.59 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStrings47.104.204.111reactjs.orgwww.w3.org

Source & flagged code

3 flagged · loading source

dist/index-CBvqcbIU.jsView file

23172function gG(r) { L23173: return U(r) ? typeof JSON < "u" && JSON.parse ? JSON.parse(r) : new Function("return (" + r + ");")() : r; L23174: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index-CBvqcbIU.jsView on unpkg · L23172

dist/assets/DialogueFormPlugin-CJjDylsj.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index-BXA17wql.js","assets/index-CGae3Rb3.js","assets/index-CBGyEflg.css","assets/ZoomOutOutlined-WWTzyqPr.js","ass... L2: import{C as JWe,F as Gn,j as _r,P as QWe,z as ZWe,G as Xee,H as t7,u as eHe,r as Ft,a as Yee,J as rHe,K as hee,d as ls,L as tHe,M as aHe,_ as Eee,q as nHe,T as sHe,I as Jee,B as Ce... L3: ... L7: * L8: * @license MIT <https://opensource.org/licenses/MIT> L9: * @author Lea Verou <https://lea.verou.me> ... L785: })() L786: `])),q)},_={ReferencedIdentifier:function(q){var U=q.node.name;if(!(U!=="module"&&U!=="exports")){var G=q.scope.getBinding(U),I=this.scope.getBinding(U);I!==G||q.parentPath.isObjec... L787: var `," = ",`;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/assets/DialogueFormPlugin-CJjDylsj.jsView on unpkg · L1

dist/DialogueFormPlugin-8yKT46xw.jsView file

•path = dist/DialogueFormPlugin-8yKT46xw.js kind = oversized_source_file sizeBytes = 4699114 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/DialogueFormPlugin-8yKT46xw.jsView on unpkg

Findings

1 High4 Medium8 Low

HighObfuscated Payload Loaderdist/assets/DialogueFormPlugin-CJjDylsj.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/DialogueFormPlugin-8yKT46xw.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/index-CBvqcbIU.js

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Maintainersyanxiangang1986, xujuntang

Version1.1.1

PublishedJul 21, 2026

Licensenone

Dependencies22

Integrityverified

Package size7.97 MB

Files386

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.jstypes → ./dist-types/client/src/lib/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact35.3 MB · 386 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessEnvironmentVarsEvalNetworkHighEntropyStringsMinifiedObfuscatedTelemetryUrlStringsNoLicense

LPM CLI

Source & flagged code

3 flagged

dist/index-CBvqcbIU.jsView file

23172function gG(r) { L23173: return U(r) ? typeof JSON < "u" && JSON.parse ? JSON.parse(r) : new Function("return (" + r + ");")() : r; L23174: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index-CBvqcbIU.jsView on unpkg · L23172

dist/assets/DialogueFormPlugin-CJjDylsj.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index-BXA17wql.js","assets/index-CGae3Rb3.js","assets/index-CBGyEflg.css","assets/ZoomOutOutlined-WWTzyqPr.js","ass... L2: import{C as JWe,F as Gn,j as _r,P as QWe,z as ZWe,G as Xee,H as t7,u as eHe,r as Ft,a as Yee,J as rHe,K as hee,d as ls,L as tHe,M as aHe,_ as Eee,q as nHe,T as sHe,I as Jee,B as Ce... L3: ... L7: * L8: * @license MIT <https://opensource.org/licenses/MIT> L9: * @author Lea Verou <https://lea.verou.me> ... L785: })() L786: `])),q)},_={ReferencedIdentifier:function(q){var U=q.node.name;if(!(U!=="module"&&U!=="exports")){var G=q.scope.getBinding(U),I=this.scope.getBinding(U);I!==G||q.parentPath.isObjec... L787: var `," = ",`;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/assets/DialogueFormPlugin-CJjDylsj.jsView on unpkg · L1

dist/DialogueFormPlugin-8yKT46xw.jsView file

•path = dist/DialogueFormPlugin-8yKT46xw.js kind = oversized_source_file sizeBytes = 4699114 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/DialogueFormPlugin-8yKT46xw.jsView on unpkg