Loading npm security reports…

@truenas/ui-components@0.3.16: Suspicious npm security report | LPM Firewall

registry / @truenas/ui-components / 0.3.16

@truenas/ui-components@0.3.16

A comprehensive Angular component library for TrueNAS and related applications, featuring a powerful icon system with automatic sprite generation.

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 21 file(s), 1.28 MB of source, external domains: pictogrammers.com, www.w3.org

Source & flagged code

4 flagged

scripts/icon-sprite/lib/find-icons-with-marker.tsView file

Lines 1-21typescript

1import { spawnSync } from 'node:child_process';

2import type { ScanResult } from './find-icons-in-templates';

High

Child Process

Package source references child process execution.

scripts/icon-sprite/lib/find-icons-with-marker.tsView on unpkg · L1

4export function findIconsWithMarker(path: string, skipIcons?: Set<string>): ScanResult {

5 // Updated regex to capture tnIconMarker() and libIconMarker() calls with optional second parameter

6 // Matches: tnIconMarker('name') or tnIconMarker('name', 'library') or libIconMarker('tn-name')

7 const pattern = "(tn|lib)IconMarker\\('[^']+',?\\s*'?[^'\\)]*'?\\)";

9 const icons = new Set<string>();

10 const sources = new Map<string, string[]>();

12 const addIcon = (iconName: string, sourceFile: string) => {

13 icons.add(iconName);

14 const existing = sources.get(iconName) || [];

15 existing.push(sourceFile);

16 sources.set(iconName, existing);

17 };

19 const result = spawnSync(

20 'grep',

21 ['-rEo', pattern, '--include=*.ts', '--include=*.html', path],

scripts/icon-sprite/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * CLI wrapper that uses tsx to run the TypeScript CLI

5 * This allows us to distribute TypeScript files without needing to compile them

6 */

8const { spawn } = require('child_process');

scripts/icon-sprite/generate-sprite.tsView file

Lines 57-97typescript

58 dirTemplateResult.icons.forEach(icon => templateIcons.add(icon));

59 dirMarkerResult.icons.forEach(icon => markerIcons.add(icon));

60 } else {

Source & flagged code

4 flagged · loading source

scripts/icon-sprite/lib/find-icons-with-marker.tsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code