registry / @skyscanner/backpack-web / 43.3.0

@skyscanner/backpack-web@43.3.0

Backpack Design System web library

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,102 file(s), 1.50 MB of source, external domains: api.figma.com, schema.org, www.apache.org, www.figma.com, www.w3.org

Source & flagged code

2 flagged

bpk-component-input/src/common-types.jsView file

Lines 8-32javascript

8 * You may obtain a copy of the License at

9 *

10 * http://www.apache.org/licenses/LICENSE-2.0

11 *

12 * Unless required by applicable law or agreed to in writing, software

13 * distributed under the License is distributed on an "AS IS" BASIS,

14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

15 * See the License for the specific language governing permissions and

16 * limitations under the License.

17 */

19export const CLEAR_BUTTON_MODES = {

20 never: 'never',

21 whileEditing: 'whileEditing',

22 always: 'always'

23};

24export const INPUT_TYPES = {

25 text: 'text',

26 email: 'email',

27 number: 'number',

28 password: 'password',

Medium

Secret Pattern

Package contains a possible secret pattern.

bpk-component-input/src/common-types.jsView on unpkg · L28

29 tel: 'tel'

30};

32// Declaring this type here as react docgen gets confused and reads them as native input types

bpk-component-input/src/common-types.d.tsView file

Lines 1-31typescript

1import type { ComponentProps, SyntheticEvent } from 'react';

2export declare const CLEAR_BUTTON_MODES: {

3 readonly never: "never";

4 readonly whileEditing: "whileEditing";

Source & flagged code

2 flagged · loading source

bpk-component-input/src/common-types.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

bpk-component-input/src/common-types.jsView on unpkg · L28

bpk-component-input/src/common-types.d.tsView file

11patternName = generic_password severity = medium line = 11 matchedText = readonly...rd";

Medium

Secret Pattern

Hardcoded password in bpk-component-input/src/common-types.d.ts

bpk-component-input/src/common-types.d.tsView on unpkg · L11

Findings

4 Medium3 Low

MediumSecret Patternbpk-component-input/src/common-types.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternbpk-component-input/src/common-types.d.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bpk-component-input/src/common-types.jsView file

Lines 8-32javascript

8 * You may obtain a copy of the License at

9 *

10 * http://www.apache.org/licenses/LICENSE-2.0

11 *

12 * Unless required by applicable law or agreed to in writing, software

13 * distributed under the License is distributed on an "AS IS" BASIS,

14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

15 * See the License for the specific language governing permissions and

16 * limitations under the License.

17 */

19export const CLEAR_BUTTON_MODES = {

20 never: 'never',

21 whileEditing: 'whileEditing',

22 always: 'always'

23};

24export const INPUT_TYPES = {

25 text: 'text',

26 email: 'email',

27 number: 'number',

28 password: 'password',

Medium

Secret Pattern

Package contains a possible secret pattern.

bpk-component-input/src/common-types.jsView on unpkg · L28

29 tel: 'tel'

30};

32// Declaring this type here as react docgen gets confused and reads them as native input types

bpk-component-input/src/common-types.d.tsView file

Lines 1-31typescript

1import type { ComponentProps, SyntheticEvent } from 'react';

2export declare const CLEAR_BUTTON_MODES: {

3 readonly never: "never";

4 readonly whileEditing: "whileEditing";