registry / @telicent-oss/ds / 3.3.0

@telicent-oss/ds@3.3.0

A component library for creating Telicent apps.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 512 KB of source, external domains: fb.me, mui.com, react.dev, reactrouter.com

Oversized source lightweight scan

dist/ds.js6.19 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsfb.memui.comreact.devreactrouter.com

dist/ds.umd.cjs6.48 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsfb.memui.comreact.devreactrouter.com

Source & flagged code

4 flagged

package.jsonView file

Lines 55-95json

55 "start": "vite",

56 "build:llms": "yarn build && yarn generate:llms",

57 "generate:llms": "node scripts/build-llms.mjs",

58 "prebuild": "yarn clean",

59 "build": "vite build",

60 "preview": "vite preview",

61 "test": "jest",

62 "test:diff": "jest --watchAll=false --coverage=false --onlyChanged --bail",

63 "test:diffMain": "jest --watchAll=false --coverage=false --changedSince=origin/main --bail",

64 "storybook": "storybook dev -p 6006",

65 "build-storybook": "storybook build",

66 "storybook-docs": "storybook dev --docs --no-manager-cache",

67 "build-storybook-docs": "storybook build --docs",

68 "test:ci": "yarn test --ci --json --outputFile=\"results.json\" --watchAll=false",

69 "chromatic": "chromatic --exit-zero-on-changes",

70 "css": "npx tailwindcss -i ./src/index.css -o ./src/main.css",

71 "prestart": "yarn run css",

72 "bump:prerelease": "yarn version --prerelease && git push && git push --tags",

73 "bump:pre": "yarn bump:prerelease",

74 "link-to-local-packages": "./scripts/link-to-local-packages.sh",

75 "postinstall": "[ \"$LOCAL_MACHINE\" = \"false\" ] && echo 'Skipping tefe hook-postinstall' || tefe hook-postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L75

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L75

76 "local-publish": "./scripts/local-publish.sh",

77 "lp": "yarn local-publish",

78 "local-install": "yarn install --registry http://localhost:4873",

79 "postlocal-publish": "./scripts/update-deps.mjs --file ./updateDeps.gitignored.json",

80 "git-checks": " ./.husky/pre-commit && ./.husky/pre-push",

81 "git-hooks": "yarn git-checks",

82 "prepare": "husky install"

83 },

84 "peerDependencies": {

85 "@tanstack/react-query": "*",

86 "@telicent-oss/ontologyservice": "^1.0.2",

87 "axios": "*",

88 "react": "^19.0.0",

89 "react-dom": "^19.0.0"

90 },

91 "browserslist": {

92 "production": [

93 ">0.2%",

94 "not dead",

95 "not op_mini all"

dist/assets/fonts/figtree/figtree-black.woff2View file

•path = [redacted]-black.woff2 kind = high_entropy_blob sizeBytes = 22884 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/fonts/figtree/figtree-black.woff2View on unpkg

dist/ds.umd.cjsView file

•path = dist/ds.umd.cjs kind = oversized_source_file sizeBytes = 6796899 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ds.umd.cjsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = [ "$LOCAL_MACHINE" = "false" ] && echo 'Skipping tefe hook-postinstall' || tefe hook-postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = [ "$LOCAL_MACHINE" = "false" ] && echo 'Skipping tefe hook-postinstall' || tefe hook-postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/assets/fonts/figtree/figtree-black.woff2View file

•path = [redacted]-black.woff2 kind = high_entropy_blob sizeBytes = 22884 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/fonts/figtree/figtree-black.woff2View on unpkg

dist/ds.umd.cjsView file

•path = dist/ds.umd.cjs kind = oversized_source_file sizeBytes = 6796899 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ds.umd.cjsView on unpkg

Findings

3 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdist/assets/fonts/figtree/figtree-black.woff2

HighOversized Source Filedist/ds.umd.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 55-95json

55 "start": "vite",

56 "build:llms": "yarn build && yarn generate:llms",

57 "generate:llms": "node scripts/build-llms.mjs",

58 "prebuild": "yarn clean",

59 "build": "vite build",

60 "preview": "vite preview",

61 "test": "jest",

62 "test:diff": "jest --watchAll=false --coverage=false --onlyChanged --bail",

63 "test:diffMain": "jest --watchAll=false --coverage=false --changedSince=origin/main --bail",

64 "storybook": "storybook dev -p 6006",

65 "build-storybook": "storybook build",

66 "storybook-docs": "storybook dev --docs --no-manager-cache",

67 "build-storybook-docs": "storybook build --docs",

68 "test:ci": "yarn test --ci --json --outputFile=\"results.json\" --watchAll=false",

69 "chromatic": "chromatic --exit-zero-on-changes",

70 "css": "npx tailwindcss -i ./src/index.css -o ./src/main.css",

71 "prestart": "yarn run css",

72 "bump:prerelease": "yarn version --prerelease && git push && git push --tags",

73 "bump:pre": "yarn bump:prerelease",

74 "link-to-local-packages": "./scripts/link-to-local-packages.sh",

75 "postinstall": "[ \"$LOCAL_MACHINE\" = \"false\" ] && echo 'Skipping tefe hook-postinstall' || tefe hook-postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L75

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L75

76 "local-publish": "./scripts/local-publish.sh",

77 "lp": "yarn local-publish",

78 "local-install": "yarn install --registry http://localhost:4873",

79 "postlocal-publish": "./scripts/update-deps.mjs --file ./updateDeps.gitignored.json",

80 "git-checks": " ./.husky/pre-commit && ./.husky/pre-push",

81 "git-hooks": "yarn git-checks",

82 "prepare": "husky install"

83 },

84 "peerDependencies": {

85 "@tanstack/react-query": "*",

86 "@telicent-oss/ontologyservice": "^1.0.2",

87 "axios": "*",

88 "react": "^19.0.0",

89 "react-dom": "^19.0.0"

90 },

91 "browserslist": {

92 "production": [

93 ">0.2%",

94 "not dead",

95 "not op_mini all"

dist/assets/fonts/figtree/figtree-black.woff2View file

•path = [redacted]-black.woff2 kind = high_entropy_blob sizeBytes = 22884 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/fonts/figtree/figtree-black.woff2View on unpkg

dist/ds.umd.cjsView file

•path = dist/ds.umd.cjs kind = oversized_source_file sizeBytes = 6796899 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ds.umd.cjsView on unpkg