registry / @truenas/ui-components / 0.3.24

@truenas/ui-components@0.3.24

A comprehensive Angular component library for TrueNAS and related applications, featuring a powerful icon system with automatic sprite generation.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 21 file(s), 1.37 MB of source, external domains: pictogrammers.com, www.w3.org

Source & flagged code

4 flagged

scripts/icon-sprite/lib/find-icons-with-marker.tsView file

Lines 1-21typescript

1import { spawnSync } from 'node:child_process';

2import type { ScanResult } from './find-icons-in-templates';

High

Child Process

Package source references child process execution.

scripts/icon-sprite/lib/find-icons-with-marker.tsView on unpkg · L1

Source & flagged code

4 flagged · loading source

scripts/icon-sprite/lib/find-icons-with-marker.tsView file

1import { spawnSync } from 'node:child_process'; L2: import type { ScanResult } from './find-icons-in-templates';

High

Child Process

Package source references child process execution.

scripts/icon-sprite/lib/find-icons-with-marker.tsView on unpkg · L1

scripts/icon-sprite/cli.jsView file

15// Use npx to run tsx, which will find it in node_modules L16: const child = spawn('npx', ['tsx', cliPath, ...process.argv.slice(2)], { L17: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/icon-sprite/cli.jsView on unpkg · L15

7L8: const { spawn } = require('child_process'); L9: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/icon-sprite/cli.jsView on unpkg · L7

scripts/icon-sprite/generate-sprite.tsView file

77if (fs.existsSync(customDir)) { L78: // Temporarily set __dirname context for addCustomIcons L79: // This is a workaround since addCustomIcons uses __dirname ... L174: try { L175: const libraryConfig = JSON.parse(fs.readFileSync(librarySpritePath, 'utf-8')); L176: const libraryIcons = libraryConfig.icons || [];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/icon-sprite/generate-sprite.tsView on unpkg · L77

Findings

3 High2 Medium5 Low

HighChild Processscripts/icon-sprite/lib/find-icons-with-marker.ts

HighShell

HighRuntime Package Installscripts/icon-sprite/cli.js

MediumDynamic Requirescripts/icon-sprite/cli.js

MediumStructural Risk Force Deep Review

LowWeak Cryptoscripts/icon-sprite/generate-sprite.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LPM CLI

Source & flagged code

4 flagged

scripts/icon-sprite/lib/find-icons-with-marker.tsView file

Lines 1-21typescript

1import { spawnSync } from 'node:child_process';

2import type { ScanResult } from './find-icons-in-templates';

High

Child Process

Package source references child process execution.

scripts/icon-sprite/lib/find-icons-with-marker.tsView on unpkg · L1

3

4export function findIconsWithMarker(path: string, skipIcons?: Set<string>): ScanResult {

5 // Updated regex to capture tnIconMarker() and libIconMarker() calls with optional second parameter

6 // Matches: tnIconMarker('name') or tnIconMarker('name', 'library') or libIconMarker('tn-name')

7 const pattern = "(tn|lib)IconMarker\$'[^']+',?\\s*'?[^'\$]*'?\\)";

8

9 const icons = new Set<string>();

10 const sources = new Map<string, string[]>();

11

12 const addIcon = (iconName: string, sourceFile: string) => {

13 icons.add(iconName);

14 const existing = sources.get(iconName) || [];

15 existing.push(sourceFile);

16 sources.set(iconName, existing);

17 };

18

19 const result = spawnSync(

20 'grep',

21 ['-rEo', pattern, '--include=*.ts', '--include=*.html', path],

scripts/icon-sprite/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2

3/**

4 * CLI wrapper that uses tsx to run the TypeScript CLI

5 * This allows us to distribute TypeScript files without needing to compile them

6 */

7

8const { spawn } = require('child_process');

9const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/icon-sprite/cli.jsView on unpkg · L7

10

11// Get the directory where this script is located

12const scriptDir = __dirname;

13const cliPath = path.join(scriptDir, 'cli-main.ts');

14

15// Use npx to run tsx, which will find it in node_modules

16const child = spawn('npx', ['tsx', cliPath, ...process.argv.slice(2)], {

17 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/icon-sprite/cli.jsView on unpkg · L15

18 cwd: process.cwd(),

19 shell: process.platform === 'win32'

20});

21

22child.on('exit', (code) => {

23 process.exit(code || 0);

24});

25

26child.on('error', (err) => {

27 console.error('Failed to start tsx:', err.message);

28 console.error('Make sure tsx is installed as a dependency of truenas-ui.');

29 process.exit(1);

30});

31

scripts/icon-sprite/generate-sprite.tsView file

Lines 57-97typescript

57

58 dirTemplateResult.icons.forEach(icon => templateIcons.add(icon));

59 dirMarkerResult.icons.forEach(icon => markerIcons.add(icon));

60 } else {

61 console.warn(`Source directory not found, skipping: ${srcDir}`);

62 }

63 }

64

65 // Combine library icons + consumer-specific icons

66 const consumerIconCount = templateIcons.size + markerIcons.size;

67 const usedIcons = new Set([...libraryIcons, ...templateIcons, ...markerIcons]);

68

69 if (consumerIconCount > 0) {

70 console.info(`Found ${consumerIconCount} additional icon(s) in consumer application`);

71 }

72

73 // Add custom icons if directory is specified

74 let allIcons: Set<string>;

75 if (resolved.customIconsDir) {

76 const customDir = resolve(resolved.projectRoot, resolved.customIconsDir);

77 if (fs.existsSync(customDir)) {

78 // Temporarily set __dirname context for addCustomIcons

79 // This is a workaround since addCustomIcons uses __dirname

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/icon-sprite/generate-sprite.tsView on unpkg · L77

80 allIcons = addCustomIconsFromPath(usedIcons, customDir);

81 } else {

82 console.warn(`Custom icons directory not found: ${customDir}`);

83 allIcons = usedIcons;

84 }

85 } else {

86 allIcons = usedIcons;

87 }

88

89 warnAboutDuplicates(allIcons);

90

91 if (!allIcons.size) {

92 throw new Error('No icons found in the project. Make sure your templates include <tn-icon> elements or use tnIconMarker() for dynamic icons.');

93 }

94

95 const icons = getIconPaths(allIcons, resolved.projectRoot);

96

97 const result = await buildSprite(icons);