registry / @univerjs-pro/collaboration-client / 0.25.1
@univerjs-pro/collaboration-client@0.25.1
Client-side collaboration plugin for Univer Pro.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
HighEntropyStringsMinifiedObfuscated
NoLicense
Source & flagged code
2 flaggedlib/locale/pl-PL.jsView file
1const _0x454e03=_0x6464;(function(_0x1977b7,_0x5e738a){const _0x2c782d=_0x6464,_0x1c0333=_0x1977b7();while(!![]){try{const _0x165b7d=-parseInt(_0x2c782d(0xb1))/0x1+parseInt(_0x2c78...
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
lib/locale/pl-PL.jsView on unpkg · L1lib/umd/index.jsView file
1package = @univerjs-pro/collaboration-client; repositoryIdentity = univer; dependency = @univerjs-pro/collaboration
L1: (function(_0x2404bf,_0x2a3492){const _0x5ff4f5=_0x1555,_0x523978=_0x2404bf();while(!![]){try{const _0x1a7b58=-parseInt(_0x5ff4f5(0x332))/0x1*(parseInt(_0x5ff4f5(0x2c4))/0x2)+parseI...
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
lib/umd/index.jsView on unpkg · L1Findings
3 High1 Medium3 Low
HighObfuscated Payload Loaderlib/locale/pl-PL.js
HighCopied Package Dependency Bridgelib/umd/index.js
HighObfuscated
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @univerjs-pro/collaboration-client@0.25.1.
See all versions of @univerjs-pro/collaboration-client for other recorded verdicts.
- Review the evidence and your use of @univerjs-pro/collaboration-client@0.25.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.