registry / @simple-reporting/base / 1.0.48

@simple-reporting/base@1.0.48

Manage srl templates, build and publish

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 45 file(s), 165 KB of source, external domains: nswow-ld.nswow.ch

Source & flagged code

4 flagged

dev/.envView file

•patternName = blocked_file severity = critical matchedText = dev/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dev/.envView on unpkg

scripts/build.jsView file

Lines 14-54javascript

14import { glob } from 'glob';

15import { build as viteBuild } from 'vite';

16import {

17 readPackageJson,

18 writePackageJson,

19 readLivingDocsJson,

20 writeLivingDocsJson,

21} from './utils.js';

22import { nsWowInternalLddUrl } from './config.js';

23import folders, { srlSystem } from './folders.js';

24import { mapLdd } from './ldd/mapLdd.js';

25import { LivingdocsDesignValidator } from './ldd/LivingdocsDesignValidator.js';

26import { camelCase } from './utils.js';

27import { stripMediaFromCssFile } from './css/stripMediaFromCss.js';

28import { buildVariables } from './build/variables.js';

29import './dotenv.js';

30import { readJson } from 'fs-extra/esm';

32const placeholderId = '6297EAFB-33A0-48B8-8D64-E61CDC3E9035';

33const nswowPath = folders.srlImports;

34const outputPath = folders.srlOutput;

35const require = createRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/build.jsView on unpkg · L34

37const { Input } = require('enquirer');

39let foldersChecked = false;

41/**

42 * Checks if the required folders exist and creates them if necessary.

43 *

44 * @async

45 * @returns {Promise<boolean>} A promise that resolves to true once the folders are checked and created.

46 */

47async function checkFolders() {

48 if (!foldersChecked) {

49 foldersChecked = true;

50 try {

51 await statSync(nswowPath);

52 } catch (e) {

53 await mkdirSync(nswowPath);

54 }

dev/src/assets/fonts/Inter/Inter-Regular.woff2View file

•path = [redacted]-Regular.woff2 kind = high_entropy_blob sizeBytes = 98888 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dev/src/assets/fonts/Inter/Inter-Regular.woff2View on unpkg

package.jsonView file

Lines 1-36json

2 "name": "@simple-reporting/base",

3 "version": "1.0.48",

4 "description": "Manage srl templates, build and publish",

5 "repository": {

6 "url": "https://github.com/mmssolutionsio/simple-reporting-library"

7 },

8 "bin"

Source & flagged code

4 flagged · loading source

dev/.envView file

•patternName = blocked_file severity = critical matchedText = dev/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dev/.envView on unpkg

scripts/build.jsView file

34const outputPath = folders.srlOutput; L35: const require = createRequire(import.meta.url); L36:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/build.jsView on unpkg · L34

dev/src/assets/fonts/Inter/Inter-Regular.woff2View file

•path = [redacted]-Regular.woff2 kind = high_entropy_blob sizeBytes = 98888 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dev/src/assets/fonts/Inter/Inter-Regular.woff2View on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

1 Critical2 High3 Medium4 Low

CriticalCritical Secretdev/.env

HighShips High Entropy Blobdev/src/assets/fonts/Inter/Inter-Regular.woff2

HighNode Builtin Dependency Squatpackage.json

MediumDynamic Requirescripts/build.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dev/.envView file

•patternName = blocked_file severity = critical matchedText = dev/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dev/.envView on unpkg

scripts/build.jsView file

Lines 14-54javascript

14import { glob } from 'glob';

15import { build as viteBuild } from 'vite';

16import {

17 readPackageJson,

18 writePackageJson,

19 readLivingDocsJson,

20 writeLivingDocsJson,

21} from './utils.js';

22import { nsWowInternalLddUrl } from './config.js';

23import folders, { srlSystem } from './folders.js';

24import { mapLdd } from './ldd/mapLdd.js';

25import { LivingdocsDesignValidator } from './ldd/LivingdocsDesignValidator.js';

26import { camelCase } from './utils.js';

27import { stripMediaFromCssFile } from './css/stripMediaFromCss.js';

28import { buildVariables } from './build/variables.js';

29import './dotenv.js';

30import { readJson } from 'fs-extra/esm';

32const placeholderId = '6297EAFB-33A0-48B8-8D64-E61CDC3E9035';

33const nswowPath = folders.srlImports;

34const outputPath = folders.srlOutput;

35const require = createRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/build.jsView on unpkg · L34

37const { Input } = require('enquirer');

39let foldersChecked = false;

41/**

42 * Checks if the required folders exist and creates them if necessary.

43 *

44 * @async

45 * @returns {Promise<boolean>} A promise that resolves to true once the folders are checked and created.

46 */

47async function checkFolders() {

48 if (!foldersChecked) {

49 foldersChecked = true;

50 try {

51 await statSync(nswowPath);

52 } catch (e) {

53 await mkdirSync(nswowPath);

54 }

dev/src/assets/fonts/Inter/Inter-Regular.woff2View file

•path = [redacted]-Regular.woff2 kind = high_entropy_blob sizeBytes = 98888 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dev/src/assets/fonts/Inter/Inter-Regular.woff2View on unpkg

package.jsonView file

Lines 1-36json

2 "name": "@simple-reporting/base",

3 "version": "1.0.48",

4 "description": "Manage srl templates, build and publish",

5 "repository": {

6 "url": "https://github.com/mmssolutionsio/simple-reporting-library"

7 },

8 "bin"