registry / @usejunior/docx-core / 0.16.0

@usejunior/docx-core@0.16.0

⚠ Under review

OOXML (.docx) core library: primitives, document generation, and track changes

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 687 KB of source, external domains: github.com, openoffice.org, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, www.w3.org

Source & flagged code

3 flagged

dist/primitives/bookmarks.jsView file

Lines 1-23javascript

1import { createHash } from 'node:crypto';

2import { OOXML, W } from './namespaces.js';

3import { getParagraphText } from './text.js';

4const W14_NS = 'http://schemas.microsoft.com/office/word/2010/wordml';

5function sha12(input) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/primitives/bookmarks.jsView on unpkg · L3

6 return createHash('sha1').update(input).digest('hex').slice(0, 12);

8function normalizeText(value) {

9 return (value ?? '').replace(/\s+/g, ' ').trim().toLowerCase();

10}

11function ancestorSignature(p) {

12 const parts = [];

13 let cur = p.parentElement;

14 while (cur) {

15 parts.push(cur.localName ?? cur.nodeName);

16 // Body/document boundary is enough context.

17 if (cur.namespaceURI === OOXML.W_NS && (cur.localName === W.body || cur.localName === W.document))

18 break;

19 cur = cur.parentElement;

20 }

21 return parts.join('/');

22}

23function getW14ParaId(p) {

dist/primitives/content_fingerprint.jsView file

Lines 6-46javascript

6 * up a stray soft hyphen (cooperate vs cooperate) or a ZWJ (AB vs A‍B)

7 * during round-tripping still fingerprints to the same value as the clean copy.

8 *

9 * Range covered (each value is a single Unicode code point):

Source & flagged code

3 flagged · loading source

dist/primitives/bookmarks.jsView file

3import { getParagraphText } from './text.js'; L4: const W14_NS = 'http://schemas.microsoft.com/office/word/2010/wordml'; L5: function sha12(input) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/primitives/bookmarks.jsView on unpkg · L3

dist/primitives/content_fingerprint.jsView file

26contains invisible/control Unicode U+200B (zero width space) const INVISIBLE_FORMAT_CHARS_RE = /[<U+200B>-<U+200F><U+202A>-<U+202E>︀-️<U+FEFF>]/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/primitives/content_fingerprint.jsView on unpkg · L26

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/primitives/index.js -> dist/primitives/content_fingerprint.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/primitives/content_fingerprint.jsView on unpkg

Findings

2 Critical2 Medium5 Low

CriticalTrojan Source Unicodedist/primitives/content_fingerprint.js

CriticalTrigger Reachable Dangerous Capabilitydist/primitives/content_fingerprint.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/primitives/bookmarks.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/primitives/bookmarks.jsView file

Lines 1-23javascript

1import { createHash } from 'node:crypto';

2import { OOXML, W } from './namespaces.js';

3import { getParagraphText } from './text.js';

4const W14_NS = 'http://schemas.microsoft.com/office/word/2010/wordml';

5function sha12(input) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/primitives/bookmarks.jsView on unpkg · L3

6 return createHash('sha1').update(input).digest('hex').slice(0, 12);

8function normalizeText(value) {

9 return (value ?? '').replace(/\s+/g, ' ').trim().toLowerCase();

10}

11function ancestorSignature(p) {

12 const parts = [];

13 let cur = p.parentElement;

14 while (cur) {

15 parts.push(cur.localName ?? cur.nodeName);

16 // Body/document boundary is enough context.

17 if (cur.namespaceURI === OOXML.W_NS && (cur.localName === W.body || cur.localName === W.document))

18 break;

19 cur = cur.parentElement;

20 }

21 return parts.join('/');

22}

23function getW14ParaId(p) {

dist/primitives/content_fingerprint.jsView file

Lines 6-46javascript

6 * up a stray soft hyphen (cooperate vs cooperate) or a ZWJ (AB vs A‍B)

7 * during round-tripping still fingerprints to the same value as the clean copy.

8 *

9 * Range covered (each value is a single Unicode code point):