registry / @tellescope/utilities / 1.255.9

@tellescope/utilities@1.255.9

Shared JS code for common actions across API and browser

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEval

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 662 KB of source, external domains: api.example.com, api.tellescope.com, calendar.google.com, cdn.example.com, example.com, staging-api.tellescope.com, www.npmjs.com

Source & flagged code

13 flagged

lib/esm/utils.d.tsView file

Lines 194-234typescript

194export declare const sanitize_html_for_cms: (html: string) => string;

195/**

196 * Canonical sanitizer for HTML that will be rendered (e.g. via `dangerouslySetInnerHTML`):

197 * form descriptions/answers, CMS/articles, care plans, templates, chat, community posts,

198 * portal HTML blocks, email bodies, etc.

199 *

200 * Uses an allowlist parser (sanitize-html) tuned to be broad on formatting/structure so

201 * legitimate customization is preserved — rich text, headings, lists, tables, images, media,

202 * inline styles, and links — while only allowlisted tags, attributes, and URL schemes are kept.

203 * If a specific surface needs embeds (e.g. YouTube), add `iframe` with `allowedIframeHostnames`

204 * for that surface rather than loosening this shared function.

205 */

206export declare const sanitize_user_html: (html: string) => string;

207export declare const query_string_for_object: (query: Indexable) => string;

208export declare const PROD_API_URL = "https://api.tellescope.com";

209export declare const STAGING_API_URL = "https://staging-api.tellescope.com";

210export declare const TEST_API_URL = "http://localhost:8080";

211export declare const getEnvironment: () => "staging" | "test" | "prod";

212export declare const getApiURL: () => "https://api.tellescope.com" | "https://staging-api.tellescope.com" | "http://localhost:8080";

213export declare const getGoogleClientId: () => "526353775713-puib79782ac254evqj2fs0sb7acsij65.apps.googleusercontent.com" | "826276796073-6rcrqp4duqatbhn8k71saopenqc2fb0i.apps.googleusercontent.com" | "842986734352-2c73i6iq2aoau3dj1jvqtmufn2j9g0dm.apps.googleusercontent.com";

214export declare const getGoogleClientAPIKey: () => "AIzaSyCYCWiLkYifffepu5L-p1x4yUExf5aWpuA" | "AIzaSyDUCT6r5qQx8yniMuP-Y9Ni08THoLQtG6M" | "AIzaSyBW9D0mg3ISvNQcSB0Z_PwHNuD0OhFdMKg";

High

High Secret

Package contains a high-severity secret pattern.

lib/esm/utils.d.tsView on unpkg · L214

High

Secret Pattern

Google API key in lib/esm/utils.d.ts

lib/esm/utils.d.tsView on unpkg · L214

215export declare const getBuiltInPublicFileName: ({ name, organizationIds }: {

216 name: 'logo' | 'favicon';

217 organizationIds?: string[] | undefined;

218}) => string;

219export declare const getOrgnizationLogoURL: ({ organizationIds, id, businessId, logoVersion, ...args }: {

220 id: string;

221 businessId: string;

222 organizationIds?: string[] | undefined;

223 logoVersion?: number | undefined;

224 apiURL?: string | undefined;

225}) => string;

226export declare const getOrgnizationFaviconURL: ({ organizationIds, businessId, id, faviconVersion, ...args }: {

227 id: string;

228 businessId: string;

229 organizationIds?: string[] | undefined;

230 faviconVersion?: number | undefined;

231 apiURL?: string | undefined;

232}) => string;

233export declare const getPublicFileURL: ({ businessId, name, version, apiURL }: {

234 businessId: string;

lib/esm/utils.jsView file

Lines 772-815javascript

772 ? 'staging'

773 : (window.location.origin.includes('localhost:') || window.location.origin.includes('127.0.0.1:')) // don't check for Tellescope, may be hosted on a custom URL

774 ? 'test'

775 : 'prod'); };

776export var

lib/cjs/utils.d.tsView file

Lines 194-234typescript

194export declare const sanitize_html_for_cms: (html: string) => string;

195/**

196 * Canonical sanitizer for HTML that will be rendered (e.g. via `dangerouslySetInnerHTML`):

197 * form descriptions/answers, CMS/articles, care plans, templates, chat, community posts,

198 * portal HTML blocks, email bodies, etc.

199 *

200 * Uses an allowlist parser (sanitize-html) tuned to be broad on formatting/structure so

lib/cjs/utils.jsView file

Lines 853-893javascript

853 : 'prod'); };

854exports.getEnvironment = getEnvironment;

855var getApiURL = function () { return (window.location.origin.includes('staging')

856 ? exports.STAGING_API_URL

857 : (window.location.origin.includes

src/utils.tsView file

839patternName = google_api_key severity = high line = 839 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L839

841patternName = google_api_key severity = high line = 841 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L841

842patternName = google_api_key severity = high line = 842 matchedText = : "AIzaS...MKg"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L842

Source & flagged code

13 flagged · loading source

lib/esm/utils.d.tsView file

214patternName = google_api_key severity = high line = 214 matchedText = export d...Kg";

High

High Secret

Package contains a high-severity secret pattern.

lib/esm/utils.d.tsView on unpkg · L214

214patternName = google_api_key severity = high line = 214 matchedText = export d...Kg";

High

Secret Pattern

Google API key in lib/esm/utils.d.ts

lib/esm/utils.d.tsView on unpkg · L214

lib/esm/utils.jsView file

792patternName = google_api_key severity = high line = 792 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L792

794patternName = google_api_key severity = high line = 794 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L794

795patternName = google_api_key severity = high line = 795 matchedText = : "AIzaS...g");

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L795

2146var number = (typeof conditionValue_1 === 'string' && conditionValue_1.startsWith("$JS(") && conditionValue_1.endsWith(")") L2147: ? new Function('answer', conditionValue_1.substring(4, conditionValue_1.length - 1))(answer) L2148: : parseInt(conditionValue_1));

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/esm/utils.jsView on unpkg · L2146

lib/cjs/utils.d.tsView file

214patternName = google_api_key severity = high line = 214 matchedText = export d...Kg";

High

Secret Pattern

Google API key in lib/cjs/utils.d.ts

lib/cjs/utils.d.tsView on unpkg · L214

lib/cjs/utils.jsView file

873patternName = google_api_key severity = high line = 873 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L873

875patternName = google_api_key severity = high line = 875 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L875

876patternName = google_api_key severity = high line = 876 matchedText = : "AIzaS...g");

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L876

src/utils.tsView file

839patternName = google_api_key severity = high line = 839 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L839

841patternName = google_api_key severity = high line = 841 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L841

842patternName = google_api_key severity = high line = 842 matchedText = : "AIzaS...MKg"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L842

Findings

12 High4 Low

HighHigh Secretlib/esm/utils.d.ts

HighSecret Patternlib/esm/utils.d.ts

HighSecret Patternlib/esm/utils.js

HighSecret Patternlib/cjs/utils.d.ts

HighSecret Patternlib/cjs/utils.js

HighSecret Patternsrc/utils.ts

LowScripts Present

LowEvallib/esm/utils.js

LowHigh Entropy Strings

LowUrl Strings