registry / @veltdev/sdk / 6.0.0-beta.3

@veltdev/sdk@6.0.0-beta.3

Velt is an SDK to add collaborative features to your product within minutes. Example: Comments like Figma, Frame.io, Google docs or sheets, Recording like Loom, Huddles like Slack and much more.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 6.42 MB of source, external domains: angular.dev, api.velt.dev, apis.google.com, boxy-svg.com, chatgptcompletion.api.velt.dev, firebase.google.com, firebasestorage.googleapis.com, getalloweddocuments.api.velt.dev, player.velt.dev, snippyly-sdk-notifications.firebaseio.com, snippyly-staging.web.app, snippyly.com, www.google.com, www.w3.org

Oversized source lightweight scan

velt-comment.js5.67 MB file, sampled 256 KB

HighEntropyStringsMinifiedUrlStringswww.w3.org

Source & flagged code

6 flagged

chunk-Q5Z6RLY4.jsView file

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

High Secret

Package contains a high-severity secret pattern.

chunk-Q5Z6RLY4.jsView on unpkg · L5

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

Secret Pattern

Google API key in chunk-Q5Z6RLY4.js

chunk-Q5Z6RLY4.jsView on unpkg · L5

chunk-WFMBKLKL.jsView file

Lines 1-7javascript

1import{$ as y,Ab as vn,Bb as yn,Bc as At,Bi as T,Ci as Un,D as Ct,Db as Et,Dc as In,De as tt,E as D,Eb as Ot,F as bt,Fa as dn,Fb as wt,G as ai,Ga as B,Ha as U,Hf as Rn,Hi as Lt,I as St,Ia as re,Ii as Nn,J as ne,Jb as Cn,Je as Tt,Kb as et,Kf as ui,L as oe,La as be,M as Ji,Na as ae,Oa as Fe,P as en,Pa as Z,Q as tn,Qe as S,Qf as O,Qi as zn,Ra as Le,S as Ce,Sa as li,T as v,Te as je,Tf as Tn,U as he,Ua as W,V as nn,Va as N,W as J,Wa as F,Xc as H,Y as on,Ya as Y,Yc as kt,Za as hn,Zh as it,_ as sn,_a as Dt,_b as Ne,a as p,aa as L,ag as Mn,b as z,ba as A,bb as Ue,ca as R,da as h,db as fe,fa as xe,fe a ...

2`],encapsulation:2,changeDetection:0})}return o})();function Hn(o,i,e){let t=e;if(!t.getBoundingClientRect)return 0;let n=t.getBoundingClientRect();return o==="horizontal"?i==="start"?n.left:n.right:i==="start"?n.top:n.bottom}var Jo=(()=>{class o{_viewContainerRef=h(Le);_template=h(be);_differs=h(Sn);_viewRepeater=h(pi);_viewport=h(Wn,{skipSelf:!0});viewChange=new _;_dataSourceChanges=new _;get cdkVirtualForOf(){return this._cdkVirtualForOf}set cdkVirtualForOf(e){this._cdkVirtualForOf=e,$n(e)?this._dataSourceChanges.next(e):this._dataSourceChanges.next(new Bt(vt(e)?e:Array.from(e||[])))}_cdkVi ...

3`],encapsulation:2,changeDetection:0})}return o})(),qt=(()=>{class o{_platform=h(H);_containerElement;_document=h(P);_styleLoader=h(Ye);constructor(){}ngOnDestroy(){this._containerElement?.remove()}getContainerElement(){return this._loadStyles(),this._containerElement||this._createContainer(),this._containerElement}_createContainer(){let e="cdk-overlay-container";if(this._platform.isBrowser||Ci()){let n=this._document.querySelectorAll(`.${e}[platform="server"], .${e}[platform="test"]`);for(let s=0;s<n.length;s++)n[s].remove()}let t=this._document.createElement("div");t.classList.add(e),Ci()?t. ...

4`],encapsulation:2,changeDetection:0})}return o})();var ls=(()=>{class o{create(e){return typeof MutationObserver>"u"?null:new MutationObserver(e)}static \u0275fac=function(t){return new(t||o)};static \u0275prov=y({token:o,factory:o.\u0275fac,providedIn:"root"})}return o})();var vo=(()=>{class o{static \u0275fac=function(t){return new(t||o)};static \u0275mod=N({type:o});static \u0275inj=L({providers:[ls]})}return o})();var Pi=(()=>{class o{_platform=h(H);constructor(){}isDisabled(e){return e.hasAttribute("disabled")}isVisible(e){return hs(e)&&getComputedStyle(e).visibility==="visible"}isTabbab ...

5`],encapsulation:2})}return o})(),ft=class{overlayRef;config;componentInstance;componentRef;containerInstance;disableClose;closed=new _;backdropClick;keydownEvents;outsidePointerEvents;id;_detachSubscription;constructor(i,e){this.overlayRef=i,this.config=e,this.disableClose=e.disableClose,this.backdropClick=i.backdropClick(),this.keydownEvents=i.keydownEvents(),this.outsidePointerEvents=i.outsidePointerEvents(),this.id=e.id,this.keydownEvents.subscribe(t=>{t.keyCode===27&&!this.disableClose&&!me(t)&&(t.preventDefault(),this.close(void 0,{focusOrigin:"keyboard"}))}),this.backdropClick.subscribe ...

6`],encapsulation:2})}return o})(),ko="--mat-dialog-transition-duration";function Ro(o){return o==null?null:typeof o=="number"?o:o.endsWith("ms")?ce(o.substring(0,o.length-2)):o.endsWith("s")?ce(o.substring(0,o.length-1))*1e3:o==="0"?0:null}var pt=(function(o){return o[o.OPEN=0]="OPEN",o[o.CLOSING=1]="CLOSING",o[o.CLOSED=2]="CLOSED",o})(pt||{}),qe=class{_ref;_config;_containerInstance;componentInstance;componentRef;disableClose;id;_afterOpened=new _;_beforeClosed=new _;_result;_closeFallbackTimeout;_state=pt.OPEN;_closeInteractionType;constructor(i,e,t){this._ref=i,this._config=e,this._containe ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-WFMBKLKL.jsView on unpkg · L5

Long lines were clipped for display.

velt-comment.jsView file

•path = velt-comment.js kind = oversized_source_file sizeBytes = 5944533 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

velt-comment.jsView on unpkg

velt-crdt.jsView file

Lines 1-2javascript

1import{a as de}from"./chunk-V4LBGV3W.js";import{$ as _,E as O,H as $,Hi as oe,I as M,Kh as Z,Lf as K,Mf as j,Pc as q,Pi as se,Qf as p,Qi as ae,T as k,Ta as G,Va as Y,Ve as X,W,Xe as f,a

velt.jsView file

Lines 1-34javascript

1var SNIPPYLY_VERSION = '6.0.0-beta.3';

2Promise.allSettled||(Promise.allSettled=function(t){return Promise.all(t.map(function(r){return Promise.resolve(r).then(function

Source & flagged code

6 flagged · loading source

chunk-Q5Z6RLY4.jsView file

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

High Secret

Package contains a high-severity secret pattern.

chunk-Q5Z6RLY4.jsView on unpkg · L5

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

Secret Pattern

Google API key in chunk-Q5Z6RLY4.js

chunk-Q5Z6RLY4.jsView on unpkg · L5

chunk-WFMBKLKL.jsView file

5`],encapsulation:2})}return o})(),ft=class{overlayRef;config;componentInstance;componentRef;containerInstance;disableClose;closed=new _;backdropClick;keydownEvents;outsidePointerEv... L6: `],encapsulation:2})}return o})(),ko="--mat-dialog-transition-duration";function Ro(o){return o==null?null:typeof o=="number"?o:o.endsWith("ms")?ce(o.substring(0,o.length-2)):o.end...

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-WFMBKLKL.jsView on unpkg · L5

velt-comment.jsView file

•path = velt-comment.js kind = oversized_source_file sizeBytes = 5944533 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

velt-comment.jsView on unpkg

velt-crdt.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = import{a...lt};

Medium

Secret Pattern

Hardcoded password in velt-crdt.js

velt-crdt.jsView on unpkg · L1

velt.jsView file

14patternName = generic_password severity = medium line = 14 matchedText = `};p.par...+`\r

Medium

Secret Pattern

Hardcoded password in velt.js

velt.jsView on unpkg · L14

Findings

3 High6 Medium7 Low

HighHigh Secretchunk-Q5Z6RLY4.js

HighOversized Source Filevelt-comment.js

HighSecret Patternchunk-Q5Z6RLY4.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

MediumSecret Patternvelt-crdt.js

MediumSecret Patternvelt.js

LowScripts Present

LowEvalchunk-WFMBKLKL.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

chunk-Q5Z6RLY4.jsView file

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

High Secret

Package contains a high-severity secret pattern.

chunk-Q5Z6RLY4.jsView on unpkg · L5

5patternName = google_api_key severity = high line = 5 matchedText = `).forEa...vg:`

High

Secret Pattern

Google API key in chunk-Q5Z6RLY4.js

chunk-Q5Z6RLY4.jsView on unpkg · L5

chunk-WFMBKLKL.jsView file

Lines 1-7javascript

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-WFMBKLKL.jsView on unpkg · L5

Long lines were clipped for display.

velt-comment.jsView file

•path = velt-comment.js kind = oversized_source_file sizeBytes = 5944533 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

velt-comment.jsView on unpkg

velt-crdt.jsView file

Lines 1-2javascript

1import{a as de}from"./chunk-V4LBGV3W.js";import{$ as _,E as O,H as $,Hi as oe,I as M,Kh as Z,Lf as K,Mf as j,Pc as q,Pi as se,Qf as p,Qi as ae,T as k,Ta as G,Va as Y,Ve as X,W,Xe as f,a

velt.jsView file

Lines 1-34javascript

1var SNIPPYLY_VERSION = '6.0.0-beta.3';

2Promise.allSettled||(Promise.allSettled=function(t){return Promise.all(t.map(function(r){return Promise.resolve(r).then(function