registry  /  @tensorzhang/tensorui  /  0.2.0

@tensorzhang/tensorui@0.2.0

Design system AI terminal — generate beautiful pages with design constraints

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsEvalFilesystem
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
WildcardDependency
scanned 2 file(s), 600 KB of source, external domains: api.anthropic.com, api.deepseek.com, github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

5 flagged · loading source
dist/design-system-server.jsView file
1var Mk=Object.create;var wl=Object.defineProperty;var Lk=Object.getOwnPropertyDescriptor;var qk=Object.getOwnPropertyNames;var Vk=Object.getPrototypeOf,Fk=Object.prototype.hasOwnPr... L2: `:""},this._extScope=e,this._scope=new $t.Scope({parent:e}),this._nodes=[new Rm]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${a} == "string" && ${r} && ${r} == +${r})`).assign(s,(0,G._)`+${r}`);return;case"integer":i.elseIf((0,G._)`${a} === "boolean" || ${r} === null L4: || (${a} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(s,(0,G._)`+${r}`);return;case"boolean":i.elseIf((0,G._)`${r} === "false" || ${r} === 0 || ${r} === null`).as... L5: || ${a} === "boolean" || ${r} === null`).assign(s,(0,G._)`[${r}]`)}}}function PP({gen:t,parentData:e,parentDataProperty:n},i){t.if((0,G._)`${e} !== undefined`,()=>t.assign((0,G._)`... L6: missingProperty: ${i}, ... L77: `);if(e===-1)return null;let n=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),C4(n)}clear(){this._buffer=void 0}};function C4(t)... L78: `}var _l=class{constructor(e=Zk.stdin,n=Zk.stdout){this._stdin=e,this._
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/design-system-server.jsView on unpkg · L1
4|| (${a} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(s,(0,G._)`+${r}`);return;case"boolean":i.elseIf((0,G._)`${r} === "false" || ${r} === 0 || ${r} === null`).as... L5: || ${a} === "boolean" || ${r} === null`).assign(s,(0,G._)`[${r}]`)}}}function PP({gen:t,parentData:e,parentDataProperty:n},i){t.if((0,G._)`${e} !== undefined`,()=>t.assign((0,G._)`... L6: missingProperty: ${i},
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/design-system-server.jsView on unpkg · L4
assets/tensor-ui-core-0.1.0.tgzView file
•path = assets/tensor-ui-core-0.1.0.tgz kind = high_entropy_blob sizeBytes = 39036 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/tensor-ui-core-0.1.0.tgzView on unpkg
•path = assets/tensor-ui-core-0.1.0.tgz kind = compressed_blob sizeBytes = 39036 magicHex = [redacted]
Medium
Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/tensor-ui-core-0.1.0.tgzView on unpkg
•path = assets/tensor-ui-core-0.1.0.tgz kind = nested_archive_needs_inspection sizeBytes = 39036 magicHex = [redacted]
Low
Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/tensor-ui-core-0.1.0.tgzView on unpkg

Findings

2 High4 Medium8 Low
HighObfuscated Payload Loaderdist/design-system-server.js
HighShips High Entropy Blobassets/tensor-ui-core-0.1.0.tgz
MediumEnvironment Vars
MediumShips Compressed Blobassets/tensor-ui-core-0.1.0.tgz
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/design-system-server.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionassets/tensor-ui-core-0.1.0.tgz