registry / @system-callifly/widget / 0.1.0-beta.9
@system-callifly/widget@0.1.0-beta.9
Callifly's embeddable voice/chat assistant widget — a framework-agnostic Web Component, usable via a <script> tag or npm install.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Oversized source lightweight scan
dist/callifly-widget.umd.cjs2.94 MB file, sampled 256 KB
NetworkChildProcessHighEntropyStringsMinifiedUrlStringsapi.vapi.aic.daily.coschemas.openxmlformats.orgschemas.zwobble.orgwww.example.com
Source & flagged code
7 flaggeddist/pdf-RgrI1mmZ.jsView file
1715}
L1716: exec(t, e) {
L1717: var c;
High
Child Process
Package source references child process execution.
dist/pdf-RgrI1mmZ.jsView on unpkg · L17156717_createCanvas(t, e) {
L6718: return process.getBuiltinModule("module").createRequire(import.meta.url)("@napi-rs/canvas").createCanvas(t, e);
L6719: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/pdf-RgrI1mmZ.jsView on unpkg · L6717dist/index-H7By0Sus.jsView file
490try {
L491: a = new Function(o, "_", i);
L492: } catch (h) {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/index-H7By0Sus.jsView on unpkg · L490Findings
5 High4 Medium6 Low
HighChild Processdist/pdf-RgrI1mmZ.js
HighSame File Env Network Executiondist/callifly-widget.umd.cjs
HighCommand Output Exfiltrationdist/callifly-widget.umd.cjs
HighTrigger Reachable Command Output Exfiltrationdist/callifly-widget.umd.cjs
HighSemantic Analysis Limiteddist/callifly-widget.umd.cjs
MediumDynamic Requiredist/pdf-RgrI1mmZ.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/index-H7By0Sus.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @system-callifly/widget@0.1.0-beta.9.
See all versions of @system-callifly/widget for other recorded verdicts.
- Review the evidence and your use of @system-callifly/widget@0.1.0-beta.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.