@tscircuit/cli@0.1.1938: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@tscircuit/cli@0.1.1938: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/cli/build/build.worker.jsView file

5328sourceCode = this.opts.code.process(sourceCode, sch); L5329: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L5330: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/build/build.worker.jsView on unpkg · L5328

dist/cli/snapshot/snapshot.worker.jsView file

46var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L47: var __require = /* @__PURE__ */ createRequire(import.meta.url); L48:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/snapshot/snapshot.worker.jsView on unpkg · L46

76var pathModule = __require("path"); L77: var isWindows = process.platform === "win32"; L78: var fs2 = __require("fs"); L79: var DEBUG = process.env.NODE_DEBUG && /fs/.test(process.env.NODE_DEBUG); L80: function rethrow() { ... L359: pre: str.slice(0, r[0]), L360: body: str.slice(r[0] + a.length, r[1]), L361: post: str.slice(r[1] + b.length) ... L413: function numeric(str) { L414: return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); L415: } ... L1207: self.changedCwd = false;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/snapshot/snapshot.worker.jsView on unpkg · L76

dist/cli/main.jsView file

•path = dist/cli/main.js kind = oversized_source_file sizeBytes = 26160817 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli/main.jsView on unpkg

•path = dist/cli/main.js kind = oversized_cli_entrypoint sizeBytes = 26160817 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli/main.jsView on unpkg

package.jsonView file

•Remote tarball dependency specs: @tscircuit/check-shorts@https://jscdn.tscircuit.com/@tscircuit/check-shorts/0.0.19.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Source & flagged code

6 flagged

dist/cli/build/build.worker.jsView file

5328sourceCode = this.opts.code.process(sourceCode, sch); L5329: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L5330: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/build/build.worker.jsView on unpkg · L5328

dist/cli/snapshot/snapshot.worker.jsView file

Lines 26-96javascript

26 enumerable: true

27 });

28 if (canCache)

29 cache.set(mod, to);

30 return to;

31};

32var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

33var __returnValue = (v) => v;

34function __exportSetter(name, newValue) {

35 this[name] = __returnValue.bind(null, newValue);

36}

37var __export = (target, all) => {

38 for (var name in all)

39 __defProp(target, name, {

40 get: all[name],

41 enumerable: true,

42 configurable: true,

43 set: __exportSetter.bind(all, name)

44 });

45};

46var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

47var __require = /* @__PURE__ */ createRequire(import.meta.url);

48

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/snapshot/snapshot.worker.jsView on unpkg · L46

49// node_modules/make-vfs/dist/index.js

50var require_dist = __commonJS((exports, module) => {

51 var __create2 = Object.create;

52 var __defProp2 = Object.defineProperty;

53 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

54 var __getOwnPropNames2 = Object.getOwnPropertyNames;

55 var __getProtoOf2 = Object.getPrototypeOf;

56 var __hasOwnProp2 = Object.prototype.hasOwnProperty;

57 var __commonJS2 = (cb, mod) => function __require2() {

58 return mod || (0, cb[__getOwnPropNames2(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

59 };

60 var __export2 = (target, all) => {

61 for (var name in all)

62 __defProp2(target, name, { get: all[name], enumerable: true });

63 };

64 var __copyProps = (to, from, except, desc) => {

65 if (from && typeof from === "object" || typeof from === "function") {

66 for (let key of __getOwnPropNames2(from))

67 if (!__hasOwnProp2.call(to, key) && key !== except)

68 __defProp2(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

69 }

70 return to;

71 };

72 var __toESM2 = (mod, isNodeMode, target) => (target = mod != null ? __create2(__getProtoOf2(mod)) : {}, __copyProps(isNodeMode || !mod ||

73 var __toCommonJS = (mod) => __copyProps(__defProp2({}, "__esModule", { value: true }), mod);

74 var require_old = __commonJS2({

75 "node_modules/fs.realpath/old.js"(exports2) {

76 var pathModule = __require("path");

77 var isWindows = process.platform === "win32";

78 var fs2 = __require("fs");

79 var DEBUG = process.env.NODE_DEBUG && /fs/.test(process.env.NODE_DEBUG);

80 function rethrow() {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/snapshot/snapshot.worker.jsView on unpkg · L76

81 var callback;

82 if (DEBUG) {

83 var backtrace = new Error;

84 callback = debugCallback;

85 } else

86 callback = missingCallback;

87 return callback;

88 function debugCallback(err) {

89 if (err) {

90 backtrace.message = err.message;

91 err = backtrace;

92 missingCallback(err);

93 }

94 }

95 function missingCallback(err) {

96 if (err) {

dist/cli/main.jsView file

•path = dist/cli/main.js kind = oversized_source_file sizeBytes = 26160817 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli/main.jsView on unpkg

•path = dist/cli/main.js kind = oversized_cli_entrypoint sizeBytes = 26160817 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli/main.jsView on unpkg

package.jsonView file

Lines 88-123json

88 "typed-ky": "^0.0.4",

89 "zod": "^3.23.8"

90 },

91 "peerDependencies": {

92 "circuit-json": "^0.0.464",

93 "tscircuit": "*"