registry / @tellescope/utilities / 1.255.9

@tellescope/utilities@1.255.9

Shared JS code for common actions across API and browser

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEval

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 662 KB of source, external domains: api.example.com, api.tellescope.com, calendar.google.com, cdn.example.com, example.com, staging-api.tellescope.com, www.npmjs.com

Source & flagged code

13 flagged

lib/esm/utils.d.tsView file

Lines 194-234typescript

194export declare const sanitize_html_for_cms: (html: string) => string;

195/**

196 * Canonical sanitizer for HTML that will be rendered (e.g. via `dangerouslySetInnerHTML`):

197 * form descriptions/answers, CMS/articles, care plans, templates, chat, community posts,

198 * portal HTML blocks, email bodies, etc.

Source & flagged code

13 flagged · loading source

lib/esm/utils.d.tsView file

214patternName = google_api_key severity = high line = 214 matchedText = export d...Kg";

High

High Secret

Package contains a high-severity secret pattern.

lib/esm/utils.d.tsView on unpkg · L214

214patternName = google_api_key severity = high line = 214 matchedText = export d...Kg";

High

Secret Pattern

Google API key in lib/esm/utils.d.ts

lib/esm/utils.d.tsView on unpkg · L214

lib/esm/utils.jsView file

792patternName = google_api_key severity = high line = 792 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L792

794patternName = google_api_key severity = high line = 794 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L794

795patternName = google_api_key severity = high line = 795 matchedText = : "AIzaS...g");

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L795

2146var number = (typeof conditionValue_1 === 'string' && conditionValue_1.startsWith("$JS(") && conditionValue_1.endsWith(")") L2147: ? new Function('answer', conditionValue_1.substring(4, conditionValue_1.length - 1))(answer) L2148: : parseInt(conditionValue_1));

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/esm/utils.jsView on unpkg · L2146

lib/cjs/utils.d.tsView file

214patternName = google_api_key severity = high line = 214 matchedText = export d...Kg";

High

Secret Pattern

Google API key in lib/cjs/utils.d.ts

lib/cjs/utils.d.tsView on unpkg · L214

lib/cjs/utils.jsView file

873patternName = google_api_key severity = high line = 873 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L873

875patternName = google_api_key severity = high line = 875 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L875

876patternName = google_api_key severity = high line = 876 matchedText = : "AIzaS...g");

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L876

src/utils.tsView file

839patternName = google_api_key severity = high line = 839 matchedText = ? 'AIzaS...puA'

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L839

841patternName = google_api_key severity = high line = 841 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L841

842patternName = google_api_key severity = high line = 842 matchedText = : "AIzaS...MKg"

High

Secret Pattern

Google API key in src/utils.ts

src/utils.tsView on unpkg · L842

Findings

12 High4 Low

HighHigh Secretlib/esm/utils.d.ts

HighSecret Patternlib/esm/utils.d.ts

HighSecret Patternlib/esm/utils.js

HighSecret Patternlib/cjs/utils.d.ts

HighSecret Patternlib/cjs/utils.js

HighSecret Patternsrc/utils.ts

LowScripts Present

LowEvallib/esm/utils.js

LowHigh Entropy Strings

LowUrl Strings

lib/esm/utils.jsView file

Lines 772-815javascript

772 ? 'staging'

773 : (window.location.origin.includes('localhost:') || window.location.origin.includes('127.0.0.1:')) // don't check for Tellescope, may be hosted on a custom URL

774 ? 'test'

775 : 'prod'); };

776export var getApiURL = function () { return (window.location.origin.includes('staging')

777 ? STAGING_API_URL

778 : (window.location.origin.includes('localhost:') || window.location.origin.includes('127.0.0.1:')) // don't check for Tellescope, may be hosted on a custom URL

779 ? TEST_API_URL

780 : PROD_API_URL); };

781export var getGoogleClientId = function () {

782 var api = getApiURL();

783 return (api === PROD_API_URL

784 ? "526353775713-puib79782ac254evqj2fs0sb7acsij65.apps.googleusercontent.com"

785 : api === STAGING_API_URL

786 ? '826276796073-6rcrqp4duqatbhn8k71saopenqc2fb0i.apps.googleusercontent.com'

787 : '842986734352-2c73i6iq2aoau3dj1jvqtmufn2j9g0dm.apps.googleusercontent.com');

788};

789export var getGoogleClientAPIKey = function () {

790 var api = getApiURL();

791 return (api === PROD_API_URL

792 ? 'AIzaSyCYCWiLkYifffepu5L-p1x4yUExf5aWpuA'

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L792

793 : api === STAGING_API_URL

794 ? "AIzaSyDUCT6r5qQx8yniMuP-Y9Ni08THoLQtG6M"

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L794

795 : "AIzaSyBW9D0mg3ISvNQcSB0Z_PwHNuD0OhFdMKg");

High

Secret Pattern

Google API key in lib/esm/utils.js

lib/esm/utils.jsView on unpkg · L795

796};

797var PUBLIC_ASSET_BUCKET = "tellescope-public-files";

798export var getBuiltInPublicFileName = function (_a) {

799 var _b;

800 var name = _a.name, organizationIds = _a.organizationIds;

801 return ("".concat(name).concat((_b = organizationIds === null || organizationIds === void 0 ? void 0 : organizationIds[organizationIds.length - 1]) !== null && _b !== void 0 ?

802};

803export var getOrgnizationLogoURL = function (_a) {

804 var organizationIds = _a.organizationIds, id = _a.id, businessId = _a.businessId, logoVersion = _a.logoVersion, args = __rest(_a, ["organizationIds", "id", "businessId", "logoVersion"]);

805 return (getPublicFileURL(__assign(__assign({}, args), { version: logoVersion, businessId: businessId !== null && businessId !== void 0 ? businessId : id, name: getBuiltInPublicFileName({ organizationIds: organizationIds, name: 'logo' }) })));

806};

807export var getOrgnizationFaviconURL = function (_a) {

808 var organizationIds = _a.organizationIds, businessId = _a.businessId, id = _a.id, faviconVersion = _a.faviconVersion, args = __rest(_a, ["organizationIds", "businessId", "id", "faviconVersion"]);

809 return (getPublicFileURL(__assign(__assign({}, args), { version: faviconVersion, businessId: businessId !== null && businessId !== void 0 ? businessId : id, name: getBuiltInPublicFileName({ organizationIds: organizationIds, name: 'favicon' }) })));

810};

811export var getPublicFileURL = function (_a) {

812 var businessId = _a.businessId, name = _a.name, version = _a.version, apiURL = _a.apiURL;

813 var api = apiURL || getApiURL();

814 var ENV_PREFIX = api === PROD_API_URL ? "prod"

815 : api === STAGING_API_URL ? "staging"

Lines 2126-2166javascript

2126 var number_1 = Date.now();

2127 var answerNumber_1 = new Date(answer.value).getTime();

2128 if (condition === '$lt') {

2129 return answerNumber_1 < number_1;

2130 }

2131 if

lib/cjs/utils.d.tsView file

Lines 194-234typescript

194export declare const sanitize_html_for_cms: (html: string) => string;

195/**

196 * Canonical sanitizer for HTML that will be rendered (e.g. via `dangerouslySetInnerHTML`):

197 * form descriptions/answers, CMS/articles, care plans, templates, chat, community posts,

198 * portal HTML blocks, email bodies, etc.

199 *

200 * Uses an allowlist parser (sanitize-html) tuned to be broad on formatting/structure so

201 * legitimate customization is preserved — rich text, headings, lists, tables, images, media,

202 * inline styles, and links — while only allowlisted tags, attributes, and URL schemes are kept.

203 * If a specific surface needs embeds (e.g. YouTube), add `iframe` with `allowedIframeHostnames`

204 * for that surface rather than loosening this shared function.

205 */

206export declare const sanitize_user_html: (html: string) => string;

207export declare const query_string_for_object: (query: Indexable) => string;

208export declare const PROD_API_URL = "https://api.tellescope.com";

209export declare const STAGING_API_URL = "https://staging-api.tellescope.com";

210export declare const TEST_API_URL = "http://localhost:8080";

211export declare const getEnvironment: () => "staging" | "test" | "prod";

212export declare const getApiURL: () => "https://api.tellescope.com" | "https://staging-api.tellescope.com" | "http://localhost:8080";

213export declare const getGoogleClientId: () => "526353775713-puib79782ac254evqj2fs0sb7acsij65.apps.googleusercontent.com" | "826276796073-6rcrqp4duqatbhn8k71saopenqc2fb0i.apps.googleusercontent.com" | "842986734352-2c73i6iq2aoau3dj1jvqtmufn2j9g0dm.apps.googleusercontent.com";

214export declare const getGoogleClientAPIKey: () => "AIzaSyCYCWiLkYifffepu5L-p1x4yUExf5aWpuA" | "AIzaSyDUCT6r5qQx8yniMuP-Y9Ni08THoLQtG6M" | "AIzaSyBW9D0mg3ISvNQcSB0Z_PwHNuD0OhFdMKg";

High

Secret Pattern

Google API key in lib/cjs/utils.d.ts

lib/cjs/utils.d.tsView on unpkg · L214

215export declare const getBuiltInPublicFileName: ({ name, organizationIds }: {

216 name: 'logo' | 'favicon';

217 organizationIds?: string[] | undefined;

218}) => string;

219export declare const getOrgnizationLogoURL: ({ organizationIds, id, businessId, logoVersion, ...args }: {

220 id: string;

221 businessId: string;

222 organizationIds?: string[] | undefined;

223 logoVersion?: number | undefined;

224 apiURL?: string | undefined;

225}) => string;

226export declare const getOrgnizationFaviconURL: ({ organizationIds, businessId, id, faviconVersion, ...args }: {

227 id: string;

228 businessId: string;

229 organizationIds?: string[] | undefined;

230 faviconVersion?: number | undefined;

231 apiURL?: string | undefined;

232}) => string;

233export declare const getPublicFileURL: ({ businessId, name, version, apiURL }: {

234 businessId: string;

lib/cjs/utils.jsView file

Lines 853-893javascript

853 : 'prod'); };

854exports.getEnvironment = getEnvironment;

855var getApiURL = function () { return (window.location.origin.includes('staging')

856 ? exports.STAGING_API_URL

857 : (window.location.origin.includes('localhost:') || window.location.origin.includes('127.0.0.1:')) // don't check for Tellescope, may be hosted on a custom URL

858 ? exports.TEST_API_URL

859 : exports.PROD_API_URL); };

860exports.getApiURL = getApiURL;

861var getGoogleClientId = function () {

862 var api = (0, exports.getApiURL)();

863 return (api === exports.PROD_API_URL

864 ? "526353775713-puib79782ac254evqj2fs0sb7acsij65.apps.googleusercontent.com"

865 : api === exports.STAGING_API_URL

866 ? '826276796073-6rcrqp4duqatbhn8k71saopenqc2fb0i.apps.googleusercontent.com'

867 : '842986734352-2c73i6iq2aoau3dj1jvqtmufn2j9g0dm.apps.googleusercontent.com');

868};

869exports.getGoogleClientId = getGoogleClientId;

870var getGoogleClientAPIKey = function () {

871 var api = (0, exports.getApiURL)();

872 return (api === exports.PROD_API_URL

873 ? 'AIzaSyCYCWiLkYifffepu5L-p1x4yUExf5aWpuA'

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L873

874 : api === exports.STAGING_API_URL

875 ? "AIzaSyDUCT6r5qQx8yniMuP-Y9Ni08THoLQtG6M"

876 : "AIzaSyBW9D0mg3ISvNQcSB0Z_PwHNuD0OhFdMKg");

877};

878exports.getGoogleClientAPIKey = getGoogleClientAPIKey;

879var PUBLIC_ASSET_BUCKET = "tellescope-public-files";

880var getBuiltInPublicFileName = function (_a) {

881 var _b;

882 var name = _a.name, organizationIds = _a.organizationIds;

883 return ("".concat(name).concat((_b = organizationIds === null || organizationIds === void 0 ? void 0 : organizationIds[organizationIds.length - 1]) !== null && _b !== void 0 ?

884};

885exports.getBuiltInPublicFileName = getBuiltInPublicFileName;

886var getOrgnizationLogoURL = function (_a) {

887 var organizationIds = _a.organizationIds, id = _a.id, businessId = _a.businessId, logoVersion = _a.logoVersion, args = __rest(_a, ["organizationIds", "id", "businessId", "logoVersion"]);

888 return ((0, exports.getPublicFileURL)(__assign(__assign({}, args), { version: logoVersion, businessId: businessId !== null && businessId !== void 0 ? businessId : id, name: (0, exports.getBuiltInPublicFileName)({ organizationIds: organizationIds, name: 'logo' }) })));

889};

890exports.getOrgnizationLogoURL = getOrgnizationLogoURL;

891var getOrgnizationFaviconURL = function (_a) {

892 var organizationIds = _a.organizationIds, businessId = _a.businessId, id = _a.id, faviconVersion = _a.faviconVersion, args = __rest(_a, ["organizationIds", "businessId", "id", "faviconVersion"]);

893 return ((0, exports.getPublicFileURL)(__assign(__assign({}, args), { version: faviconVersion, businessId: businessId !== null && businessId !== void 0 ? businessId : id, name: (0, exports.getBuiltInPublicFileName)({ organizationIds: organizationIds, name: 'favicon' }) })));

875patternName = google_api_key severity = high line = 875 matchedText = ? "AIzaS...G6M"

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L875

876patternName = google_api_key severity = high line = 876 matchedText = : "AIzaS...g");

High

Secret Pattern

Google API key in lib/cjs/utils.js

lib/cjs/utils.jsView on unpkg · L876