registry / @veltdev/sdk / 6.0.0-beta.8

@veltdev/sdk@6.0.0-beta.8

Velt is an SDK to add collaborative features to your product within minutes. Example: Comments like Figma, Frame.io, Google docs or sheets, Recording like Loom, Huddles like Slack and much more.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 6.45 MB of source, external domains: angular.dev, api.velt.dev, apis.google.com, boxy-svg.com, chatgptcompletion.api.velt.dev, firebase.google.com, firebasestorage.googleapis.com, getalloweddocuments.api.velt.dev, player.velt.dev, snippyly-sdk-notifications.firebaseio.com, snippyly-staging.web.app, snippyly.com, www.google.com, www.w3.org

Oversized source lightweight scan

velt-comment.js5.68 MB file, sampled 256 KB

HighEntropyStringsMinifiedUrlStringswww.w3.org

Source & flagged code

6 flagged

chunk-R7YZOCNX.jsView file

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

High Secret

Package contains a high-severity secret pattern.

chunk-R7YZOCNX.jsView on unpkg · L5

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

Secret Pattern

Google API key in chunk-R7YZOCNX.js

chunk-R7YZOCNX.jsView on unpkg · L5

chunk-3QPIMTRP.jsView file

Lines 1-7javascript

1import{$ as y,Ab as vn,Ae as S,Bb as yn,Bc as At,Bf as O,D as Ct,Db as Et,Dc as In,De as je,E as D,Eb as Ot,Ef as Tn,F as bt,Fa as dn,Fb as wt,G as ai,Ga as B,Ha as U,Hi as zn,I as St,Ia as re,J as ne,Jb as Cn,Kb as et,L as oe,La as be,M as Ji,Mh as it,Na as ae,Nf as Mn,Oa as Fe,P as en,Pa as Z,Q as tn,Ra as Le,Rd as Dn,S as Ce,Sa as li,Sd as En,Se as wn,T as v,Te as An,U as he,Ua as W,V as nn,Va as N,W as J,Wa as F,Xc as H,Y as on,Ya as Y,Yc as kt,Ye as kn,Za as hn,_ as sn,_a as Dt,_b as Ne,a as p,aa as L,ae as On,ai as xt,b as z,ba as A,bb as Ue,bi as Fn,ca as R,ci as te,da as h,db as fe,di ...

2`],encapsulation:2,changeDetection:0})}return o})();function Hn(o,i,e){let t=e;if(!t.getBoundingClientRect)return 0;let n=t.getBoundingClientRect();return o==="horizontal"?i==="start"?n.left:n.right:i==="start"?n.top:n.bottom}var Jo=(()=>{class o{_viewContainerRef=h(Le);_template=h(be);_differs=h(Sn);_viewRepeater=h(pi);_viewport=h(Wn,{skipSelf:!0});viewChange=new _;_dataSourceChanges=new _;get cdkVirtualForOf(){return this._cdkVirtualForOf}set cdkVirtualForOf(e){this._cdkVirtualForOf=e,$n(e)?this._dataSourceChanges.next(e):this._dataSourceChanges.next(new Bt(vt(e)?e:Array.from(e||[])))}_cdkVi ...

3`],encapsulation:2,changeDetection:0})}return o})(),qt=(()=>{class o{_platform=h(H);_containerElement;_document=h(P);_styleLoader=h(Ye);constructor(){}ngOnDestroy(){this._containerElement?.remove()}getContainerElement(){return this._loadStyles(),this._containerElement||this._createContainer(),this._containerElement}_createContainer(){let e="cdk-overlay-container";if(this._platform.isBrowser||Ci()){let n=this._document.querySelectorAll(`.${e}[platform="server"], .${e}[platform="test"]`);for(let s=0;s<n.length;s++)n[s].remove()}let t=this._document.createElement("div");t.classList.add(e),Ci()?t. ...

4`],encapsulation:2,changeDetection:0})}return o})();var ls=(()=>{class o{create(e){return typeof MutationObserver>"u"?null:new MutationObserver(e)}static \u0275fac=function(t){return new(t||o)};static \u0275prov=y({token:o,factory:o.\u0275fac,providedIn:"root"})}return o})();var vo=(()=>{class o{static \u0275fac=function(t){return new(t||o)};static \u0275mod=N({type:o});static \u0275inj=L({providers:[ls]})}return o})();var Pi=(()=>{class o{_platform=h(H);constructor(){}isDisabled(e){return e.hasAttribute("disabled")}isVisible(e){return hs(e)&&getComputedStyle(e).visibility==="visible"}isTabbab ...

5`],encapsulation:2})}return o})(),ft=class{overlayRef;config;componentInstance;componentRef;containerInstance;disableClose;closed=new _;backdropClick;keydownEvents;outsidePointerEvents;id;_detachSubscription;constructor(i,e){this.overlayRef=i,this.config=e,this.disableClose=e.disableClose,this.backdropClick=i.backdropClick(),this.keydownEvents=i.keydownEvents(),this.outsidePointerEvents=i.outsidePointerEvents(),this.id=e.id,this.keydownEvents.subscribe(t=>{t.keyCode===27&&!this.disableClose&&!me(t)&&(t.preventDefault(),this.close(void 0,{focusOrigin:"keyboard"}))}),this.backdropClick.subscribe ...

6`],encapsulation:2})}return o})(),ko="--mat-dialog-transition-duration";function Ro(o){return o==null?null:typeof o=="number"?o:o.endsWith("ms")?ce(o.substring(0,o.length-2)):o.endsWith("s")?ce(o.substring(0,o.length-1))*1e3:o==="0"?0:null}var pt=(function(o){return o[o.OPEN=0]="OPEN",o[o.CLOSING=1]="CLOSING",o[o.CLOSED=2]="CLOSED",o})(pt||{}),qe=class{_ref;_config;_containerInstance;componentInstance;componentRef;disableClose;id;_afterOpened=new _;_beforeClosed=new _;_result;_closeFallbackTimeout;_state=pt.OPEN;_closeInteractionType;constructor(i,e,t){this._ref=i,this._config=e,this._containe ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-3QPIMTRP.jsView on unpkg · L5

Long lines were clipped for display.

velt-comment.jsView file

•path = velt-comment.js kind = oversized_source_file sizeBytes = 5953700 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

velt-comment.jsView on unpkg

velt-crdt.jsView file

Lines 1-2javascript

1import{a as de}from"./chunk-HDZBYIFE.js";import{$ as _,Bf as p,E as O,Fe as Q,Fi as se,H as $,Hi as ae,I as M,Nf as z,Pc as q,T as k,Ta as G,Va as Y,Vd as f,W,Yh as ee,_h as te,a as w,aa

velt.jsView file

Lines 1-34javascript

1var SNIPPYLY_VERSION = '6.0.0-beta.8';

2Promise.allSettled||(Promise.allSettled=function(t){return Promise.all(t.map(function(r){return Promise.resolve(r).then(function

Source & flagged code

6 flagged · loading source

chunk-R7YZOCNX.jsView file

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

High Secret

Package contains a high-severity secret pattern.

chunk-R7YZOCNX.jsView on unpkg · L5

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

Secret Pattern

Google API key in chunk-R7YZOCNX.js

chunk-R7YZOCNX.jsView on unpkg · L5

chunk-3QPIMTRP.jsView file

5`],encapsulation:2})}return o})(),ft=class{overlayRef;config;componentInstance;componentRef;containerInstance;disableClose;closed=new _;backdropClick;keydownEvents;outsidePointerEv... L6: `],encapsulation:2})}return o})(),ko="--mat-dialog-transition-duration";function Ro(o){return o==null?null:typeof o=="number"?o:o.endsWith("ms")?ce(o.substring(0,o.length-2)):o.end...

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-3QPIMTRP.jsView on unpkg · L5

velt-comment.jsView file

•path = velt-comment.js kind = oversized_source_file sizeBytes = 5953700 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

velt-comment.jsView on unpkg

velt-crdt.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = import{a...lt};

Medium

Secret Pattern

Hardcoded password in velt-crdt.js

velt-crdt.jsView on unpkg · L1

velt.jsView file

14patternName = generic_password severity = medium line = 14 matchedText = `};p.par...+`\r

Medium

Secret Pattern

Hardcoded password in velt.js

velt.jsView on unpkg · L14

Findings

3 High6 Medium7 Low

HighHigh Secretchunk-R7YZOCNX.js

HighOversized Source Filevelt-comment.js

HighSecret Patternchunk-R7YZOCNX.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

MediumSecret Patternvelt-crdt.js

MediumSecret Patternvelt.js

LowScripts Present

LowEvalchunk-3QPIMTRP.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

chunk-R7YZOCNX.jsView file

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

High Secret

Package contains a high-severity secret pattern.

chunk-R7YZOCNX.jsView on unpkg · L5

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

Secret Pattern

Google API key in chunk-R7YZOCNX.js

chunk-R7YZOCNX.jsView on unpkg · L5

chunk-3QPIMTRP.jsView file

Lines 1-7javascript

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-3QPIMTRP.jsView on unpkg · L5

Long lines were clipped for display.

velt-comment.jsView file

•path = velt-comment.js kind = oversized_source_file sizeBytes = 5953700 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

velt-comment.jsView on unpkg

velt-crdt.jsView file

Lines 1-2javascript

1import{a as de}from"./chunk-HDZBYIFE.js";import{$ as _,Bf as p,E as O,Fe as Q,Fi as se,H as $,Hi as ae,I as M,Nf as z,Pc as q,T as k,Ta as G,Va as Y,Vd as f,W,Yh as ee,_h as te,a as w,aa

velt.jsView file

Lines 1-34javascript

1var SNIPPYLY_VERSION = '6.0.0-beta.8';

2Promise.allSettled||(Promise.allSettled=function(t){return Promise.all(t.map(function(r){return Promise.resolve(r).then(function