registry / @tellescope/utilities / 1.255.2

@tellescope/utilities@1.255.2

Shared JS code for common actions across API and browser

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEval

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 655 KB of source, external domains: api.example.com, api.tellescope.com, calendar.google.com, cdn.example.com, example.com, staging-api.tellescope.com, www.npmjs.com

Source & flagged code

13 flagged

lib/esm/utils.d.tsView file

Lines 192-232typescript

192export declare const sanitize_html_for_cms: (html: string) => string;

193/**

194 * Canonical sanitizer for HTML that will be rendered (e.g. via `dangerouslySetInnerHTML`):

195 * form descriptions/answers, CMS/articles, care plans, templates, chat, community posts,

196 * portal HTML blocks, email bodies, etc.

197 *

198 * Uses an allowlist parser (sanitize-html) tuned to be broad on formatting/structure so

199 * legitimate customization is preserved — rich text, headings, lists, tables, images, media,

200 * inline styles, and links — while only allowlisted tags, attributes, and URL schemes are kept.

201 * If a specific surface needs embeds (e.g. YouTube), add `iframe` with `allowedIframeHostnames`

202 * for that surface rather than loosening this shared function.

203 */

204export declare const sanitize_user_html: (html: string) => string;

205export declare const query_string_for_object: (query: Indexable) => string;

206export declare const PROD_API_URL = "https://api.tellescope.com";

207export declare const STAGING_API_URL = "https://staging-api.tellescope.com";

208export declare const TEST_API_URL = "http://localhost:8080";

209export declare const getEnvironment: () => "staging" | "test" | "prod";

210export declare const getApiURL: () => "https://api.tellescope.com" | "https://staging-api.tellescope.com" | "http://localhost:8080";

211export declare const getGoogleClientId: () => "526353775713-puib79782ac254evqj2fs0sb7acsij65.apps.googleusercontent.com" | "826276796073-6rcrqp4duqatbhn8k71saopenqc2fb0i.apps.googleusercontent.com" | "842986734352-2c73i6iq2aoau3dj1jvqtmufn2j9g0dm.apps.googleusercontent.com";

212export declare const getGoogleClientAPIKey: () => "AIzaSyCYCWiLkYifffepu5L-p1x4yUExf5aWpuA" | "AIzaSyDUCT6r5qQx8yniMuP-Y9Ni08THoLQtG6M" | "AIzaSyBW9D0mg3ISvNQcSB0Z_PwHNuD0OhFdMKg";

High

High Secret

Package contains a high-severity secret pattern.

lib/esm/utils.d.tsView on unpkg · L212

High

Secret Pattern

Google API key in lib/esm/utils.d.ts

lib/esm/utils.d.tsView on unpkg · L212

213export declare const getBuiltInPublicFileName: ({ name, organizationIds }: {

214 name: 'logo' | 'favicon';

215 organizationIds?: string[] | undefined;

216}) => string;

217export declare const getOrgnizationLogoURL: ({ organizationIds, id, businessId, logoVersion, ...args }: {

218 id: string;

219 businessId: string;

220 organizationIds?: string[] | undefined;

221 logoVersion?: number | undefined;

222 apiURL?: string | undefined;

223}) => string;

224export declare const getOrgnizationFaviconURL: ({ organizationIds, businessId, id, faviconVersion, ...args }: {

225 id: string;

226 businessId: string;

227 organizationIds?: string[] | undefined;

228 faviconVersion?: number | undefined;

229 apiURL?: string | undefined;

230}) => string;

231export declare const getPublicFileURL: ({ businessId, name, version, apiURL }: {

232 businessId: string;

lib/esm/utils.jsView file

Lines 771-814javascript

771 ? 'staging'

772 : (window.location.origin.includes('localhost:') || window.location.origin.includes('127.0.0.1:')) // don't check for Tellescope, may be hosted on a custom URL

773 ? 'test'

774 : 'prod'); };

775export var

lib/cjs/utils.d.tsView file

Lines 192-232typescript

192export declare const sanitize_html_for_cms: (html: string) => string;

193/**

194 * Canonical sanitizer for HTML that will be rendered (e.g. via `dangerouslySetInnerHTML`):

195 * form descriptions/answers, CMS/articles, care plans, templates, chat, community posts,

196 * portal HTML blocks, email bodies, etc.

197 *

198 * Uses an allowlist parser (sanitize-html) tuned to be broad on formatting/structure so

lib/cjs/utils.jsView file

Lines 852-892javascript

852 : 'prod'); };

853exports.getEnvironment = getEnvironment;

854var getApiURL = function () { return (window.location.origin.includes('staging')

855 ? exports.STAGING_API_URL

856 : (window.location.origin.includes

src/utils.tsView file

838patternName = google_api_key severity = high line = 838 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L838

840patternName = google_api_key severity = high line = 840 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L840

841patternName = google_api_key severity = high line = 841 matchedText = : "AIzaS...MKg"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L841

Source & flagged code

13 flagged · loading source

lib/esm/utils.d.tsView file

212patternName = google_api_key severity = high line = 212 matchedText = export d...Kg";

High

High Secret

Package contains a high-severity secret pattern.

lib/esm/utils.d.tsView on unpkg · L212

212patternName = google_api_key severity = high line = 212 matchedText = export d...Kg";

High

Secret Pattern

Google API key in lib/esm/utils.d.ts

lib/esm/utils.d.tsView on unpkg · L212

lib/esm/utils.jsView file

791patternName = google_api_key severity = high line = 791 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L791

793patternName = google_api_key severity = high line = 793 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L793

794patternName = google_api_key severity = high line = 794 matchedText = : "AIzaS...g");

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L794

2145var number = (typeof conditionValue_1 === 'string' && conditionValue_1.startsWith("$JS(") && conditionValue_1.endsWith(")") L2146: ? new Function('answer', conditionValue_1.substring(4, conditionValue_1.length - 1))(answer) L2147: : parseInt(conditionValue_1));

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/esm/utils.jsView on unpkg · L2145

lib/cjs/utils.d.tsView file

212patternName = google_api_key severity = high line = 212 matchedText = export d...Kg";

High

Secret Pattern

Google API key in lib/cjs/utils.d.ts

lib/cjs/utils.d.tsView on unpkg · L212

lib/cjs/utils.jsView file

872patternName = google_api_key severity = high line = 872 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L872

874patternName = google_api_key severity = high line = 874 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L874

875patternName = google_api_key severity = high line = 875 matchedText = : "AIzaS...g");

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L875

src/utils.tsView file

838patternName = google_api_key severity = high line = 838 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L838

840patternName = google_api_key severity = high line = 840 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L840

841patternName = google_api_key severity = high line = 841 matchedText = : "AIzaS...MKg"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L841

Findings

12 High4 Low

HighHigh Secretlib/esm/utils.d.ts

HighSecret Patternlib/esm/utils.d.ts

HighSecret Patternlib/esm/utils.js

HighSecret Patternlib/cjs/utils.d.ts

HighSecret Patternlib/cjs/utils.js

HighSecret Patternsrc/utils.ts

LowScripts Present

LowEvallib/esm/utils.js

LowHigh Entropy Strings

LowUrl Strings