@tensorzhang/tensorui@1.0.0: Suspicious npm security report

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 2 file(s), 601 KB of source, external domains: api.anthropic.com, api.deepseek.com, github.com, json-schema.org, raw.githubusercontent.com, www.tensorui.cn

Source & flagged code

2 flagged

dist/design-system-server.jsView file

1var Mk=Object.create;var wl=Object.defineProperty;var Lk=Object.getOwnPropertyDescriptor;var qk=Object.getOwnPropertyNames;var Vk=Object.getPrototypeOf,Fk=Object.prototype.hasOwnPr... L2: `:""},this._extScope=e,this._scope=new $t.Scope({parent:e}),this._nodes=[new Rm]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${a} == "string" && ${r} && ${r} == +${r})`).assign(s,(0,G._)`+${r}`);return;case"integer":i.elseIf((0,G._)`${a} === "boolean" || ${r} === null L4: || (${a} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(s,(0,G._)`+${r}`);return;case"boolean":i.elseIf((0,G._)`${r} === "false" || ${r} === 0 || ${r} === null`).as... L5: || ${a} === "boolean" || ${r} === null`).assign(s,(0,G._)`[${r}]`)}}}function PP({gen:t,parentData:e,parentDataProperty:n},i){t.if((0,G._)`${e} !== undefined`,()=>t.assign((0,G._)`... L6: missingProperty: ${i}, ... L77: `);if(e===-1)return null;let n=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),C4(n)}clear(){this._buffer=void 0}};function C4(t)... L78: `}var _l=class{constructor(e=Zk.stdin,n=Zk.stdout){this._stdin=e,this._

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/design-system-server.jsView on unpkg · L1

4|| (${a} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(s,(0,G._)`+${r}`);return;case"boolean":i.elseIf((0,G._)`${r} === "false" || ${r} === 0 || ${r} === null`).as... L5: || ${a} === "boolean" || ${r} === null`).assign(s,(0,G._)`[${r}]`)}}}function PP({gen:t,parentData:e,parentDataProperty:n},i){t.if((0,G._)`${e} !== undefined`,()=>t.assign((0,G._)`... L6: missingProperty: ${i},

Source & flagged code

2 flagged · loading source

dist/design-system-server.jsView file

1var Mk=Object.create;var wl=Object.defineProperty;var Lk=Object.getOwnPropertyDescriptor;var qk=Object.getOwnPropertyNames;var Vk=Object.getPrototypeOf,Fk=Object.prototype.hasOwnPr... L2: `:""},this._extScope=e,this._scope=new $t.Scope({parent:e}),this._nodes=[new Rm]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${a} == "string" && ${r} && ${r} == +${r})`).assign(s,(0,G._)`+${r}`);return;case"integer":i.elseIf((0,G._)`${a} === "boolean" || ${r} === null L4: || (${a} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(s,(0,G._)`+${r}`);return;case"boolean":i.elseIf((0,G._)`${r} === "false" || ${r} === 0 || ${r} === null`).as... L5: || ${a} === "boolean" || ${r} === null`).assign(s,(0,G._)`[${r}]`)}}}function PP({gen:t,parentData:e,parentDataProperty:n},i){t.if((0,G._)`${e} !== undefined`,()=>t.assign((0,G._)`... L6: missingProperty: ${i}, ... L77: `);if(e===-1)return null;let n=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),C4(n)}clear(){this._buffer=void 0}};function C4(t)... L78: `}var _l=class{constructor(e=Zk.stdin,n=Zk.stdout){this._stdin=e,this._

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/design-system-server.jsView on unpkg · L1

4|| (${a} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(s,(0,G._)`+${r}`);return;case"boolean":i.elseIf((0,G._)`${r} === "false" || ${r} === 0 || ${r} === null`).as... L5: || ${a} === "boolean" || ${r} === null`).assign(s,(0,G._)`[${r}]`)}}}function PP({gen:t,parentData:e,parentDataProperty:n},i){t.if((0,G._)`${e} !== undefined`,()=>t.assign((0,G._)`... L6: missingProperty: ${i},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/design-system-server.jsView on unpkg · L4

Findings

1 High3 Medium7 Low

HighObfuscated Payload Loaderdist/design-system-server.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/design-system-server.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings