registry / @vtj/pro / 0.18.14

@vtj/pro@0.18.14

VTJ.PRO 是一个开源的、AI 驱动的 Vue3 企业级应用开发平台，通过 AI 智能体与可视化编排实现高效开发，并支持导出标准 Vue 代码以避免平台锁定。

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 114 file(s), 20.0 MB of source, external domains: addons.mozilla.org, almende.com, antdv.com, api.bspapp.com, api.map.baidu.com, api.next.bspapp.com, app.vtj.pro, bugzilla.mozilla.org, chromewebstore.google.com, cli.vuejs.org, cn.vuejs.org, code.google.com, cube.elemecdn.com, developer.mozilla.org, developers.google.com, devtools.vuejs.org, drafts.csswg.org, dummyimage.com, element-plus.org, en.wikipedia.org, fastly.jsdelivr.net, fuss10.elemecdn.com, github.com, googlechrome.github.io, gw.alipayobjects.com, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, joeschmoe.io, json-schema.org, link.vuejs.org, map.qq.com, maps.googleapis.com, mathiasbynens.be, openrouter.ai, opensource.org, pinia.vuejs.org, qiniu-web-assets.dcloud.net.cn, r12a.github.io, router.vuejs.org, run.mocky.io, sass-lang.com, schema.org, stackoverflow.com, support.google.com, tools.ietf.org, uniapp.dcloud.io, unpkg.com, vant-ui.github.io, visjs.org

Oversized source lightweight scan

dist/__devtools__/assets/index-E3YKiktg.js3.03 MB file, sampled 256 KB

FilesystemNetworkChildProcessEvalDynamicRequireHighEntropyStringsMinifiedUrlStringsProtestwarevuejs.orgwww.w3.org

dist/assets/monaco-editor-Bgo-w-Z8.js4.08 MB file, sampled 256 KB

ChildProcessShellHighEntropyStringsMinified

dist/assets/ts.worker-BRcnI7fF-SiwKE4wz.js6.72 MB file, sampled 256 KB

FilesystemNetworkChildProcessShellUrlStringsdeveloper.mozilla.orgwww.apache.org

dist/assets/ts.worker-rhMheKS7.js6.71 MB file, sampled 256 KB

FilesystemNetworkChildProcessShell

Source & flagged code

9 flagged

dist/@vtj/materials/deps/@vtj/utils/index.umd.jsView file

Lines 1-21javascript

1(function(A,W){typeof exports=="object"&&typeof module<"u"?W(exports):typeof define=="function"&&define.amd?define(["exports"],W):(A=typeof globalThis<"u"?globalThis:A||self,W(A.VtjUtils={}))})(this,(function(A){"use strict";var ly=Object.defineProperty;var de=(A,W)=>(W=Symbol[A])?W:Symbol.for("Symbol."+A),hy=A=>{throw TypeError(A)};var dy=(A,W,it)=>W in A?ly(A,W,{enumerable:!0,configurable:!0,writable:!0,value:it}):A[W]=it;var Tt=(A,W,it)=>dy(A,typeof W!="symbol"?W+"":W,it);var Gt=function(A,W){this[0]=A,this[1]=W},Pn=(A,W,it)=>{var yt=(ct,Z,_t,st)=>{try{var pe=it[ct](Z),Me=(Z=pe.value)instan ...

3 * @name @vtj/utils

4 * @author CHC chenhuachun1549@dingtalk.com

5 * @version 0.18.14

6 * @license <a href="https://vtj.pro/license.html">MIT License</a>

7 */const W="0.18.14";var it={ENV_TYPE:"local",NODE_ENV:"production"},yt=typeof global=="object"&&global&&global.Object===Object&&global;const ut=yt;var et=typeof self=="object"&&self&&

8 * @fileOverview

9 * @name asn1-1.0.js

10 * @author Kenji Urushima kenji.urushima@gmail.com

11 * @version asn1 1.0.13 (2017-Jun-02)

12 * @since jsrsasign 2.1

13 * @license <a href="https://kjur.github.io/jsrsasign/license/">MIT License</a>

14 */var B={};(typeof B.asn1>"u"||!B.asn1)&&(B.asn1={}),B.asn1.ASN1Util=new function(){this.integerToByteHex=function(e){var t=e.toString(16);return t.length%

15 * numeral.js

16 * version : 2.0.6

17 * author : Adam Draper

18 * license : MIT

19 * http://adamwdraper.github.com/Numeral-js/

20 */(function(e){(function(t,r){e.exports?e.exports=r():t.numeral=r()})(pt,function(){var t,r,n="2.0.6",i={},s={},o={currentLocale:"en",zeroFormat:null,nullFormat:null,defaultFormat:"0,0",scalePercentBy100:!0},u={currentLocale:o.currentLocale,zeroFormat:o.zeroFormat,nullFormat:o.nullFormat,defaultFormat:o.defaultFormat,scalePercentBy100:o.scalePercentBy100};

Long lines were clipped for display.

dist/@vtj/materials/deps/mockjs/mock-min.jsView file

Lines 1-10javascript

1!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.Mock=

dist/@vtj/materials/deps/uni-ui/index.umd.jsView file

Lines 1-2javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("@dcloudio/uni-h5"),require("vue"),require("@dcloudio/uni-app")):"function"==typeof define&&define.amd?

dist/assets/iconfont.1732169275522-D4HyIDhF.woffView file

•path = dist/assets/iconfont.1732169275522-D4HyIDhF.woff kind = high_entropy_blob sizeBytes = 21212 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/iconfont.1732169275522-D4HyIDhF.woffView on unpkg

dist/__devtools__/assets/index-E3YKiktg.jsView file

•path = dist/__devtools__/assets/index-E3YKiktg.js kind = oversized_source_file sizeBytes = 3172785 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/__devtools__/assets/index-E3YKiktg.jsView on unpkg

dist/uni/assets/index-D_QsbzKe.jsView file

Lines 15-55javascript

15`)+"var __t, __p = ''"+(o?", __e = _.escape":"")+(u?`, __j = Array.prototype.join;

16function print() { __p += __j.call(arguments, '') }

17`:`;

18`)+h+`return __p

19}`;var m=rh(function(){return Function(s,f+"return "+h).apply(void 0,a)});if(m.source=h,la(m))throw m;return m}var hg="Expected a function";function pg(t,e,r){var n=!0,i=!0;if(typeof t!="function")throw new TypeError(hg);return Ae(r)&&(n="leading"in r?!0:n,i="trailing"in r?!1:i),Jn(t,e,{leading:n,maxWait:e,trailing:i})}function fg(t){return ya($e(t))}var de=typeof globalThis!="undefined"?globalThis:typeof window!="undefined"?window:typeof global!="undefined"?global:typeof self!="undefined"?self:{};function dg(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"default")?t.defaul ...

dist/assets/Editor-uPV3tKdM-CYWQH8Ar.jsView file

34patternName = private_key_rsa severity = critical line = 34 matchedText = `)},e.pr...----

Critical

Secret Pattern

RSA private key in dist/assets/Editor-uPV3tKdM-CYWQH8Ar.js

dist/assets/Editor-uPV3tKdM-CYWQH8Ar.jsView on unpkg · L34

Source & flagged code

9 flagged · loading source

dist/@vtj/materials/deps/@vtj/utils/index.umd.jsView file

14patternName = private_key_rsa severity = critical line = 14 matchedText = */var B=...erve

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/@vtj/materials/deps/@vtj/utils/index.umd.jsView on unpkg · L14

14patternName = private_key_rsa severity = critical line = 14 matchedText = */var B=...erve

Critical

Secret Pattern

RSA private key in dist/@vtj/materials/deps/@vtj/utils/index.umd.js

dist/@vtj/materials/deps/@vtj/utils/index.umd.jsView on unpkg · L14

dist/@vtj/materials/deps/mockjs/mock-min.jsView file

5*/ L6: var s={Handler:a,Random:u,Util:o,XHR:r,RE:i,toJSONSchema:l,valid:c,heredoc:o.heredoc,setup:function(t){return r.setup(t)},_mocked:{}};s.version="1.0.1-beta3",r&&(r.Mock=s),s.mock=f... L7: 150104:"玉泉区",150105:"赛罕区",150121:"土默特左旗",150122:"托克托县",150123:"和林格尔县",150124:"清水河县",150125:"武川县",150126:"其它区",150200:"包头市",150202:"东河区",150203:"昆都仑区",150204:"青山区",150205:"石拐区",1502...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/@vtj/materials/deps/mockjs/mock-min.jsView on unpkg · L5

dist/@vtj/materials/deps/uni-ui/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("@dcloudio/uni-h5"),require("vue"),require("@dcloudio/uni-app")):"function"==typeof define&&de...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/@vtj/materials/deps/uni-ui/index.umd.jsView on unpkg · L1

dist/assets/iconfont.1732169275522-D4HyIDhF.woffView file

•path = dist/assets/iconfont.1732169275522-D4HyIDhF.woff kind = high_entropy_blob sizeBytes = 21212 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/iconfont.1732169275522-D4HyIDhF.woffView on unpkg

dist/__devtools__/assets/index-E3YKiktg.jsView file

•path = dist/__devtools__/assets/index-E3YKiktg.js kind = oversized_source_file sizeBytes = 3172785 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/__devtools__/assets/index-E3YKiktg.jsView on unpkg

dist/uni/assets/index-D_QsbzKe.jsView file

35patternName = private_key_rsa severity = critical line = 35 matchedText = `)},e.pr...----

Critical

Secret Pattern

RSA private key in dist/uni/assets/index-D_QsbzKe.js

dist/uni/assets/index-D_QsbzKe.jsView on unpkg · L35

•matchType = previous_version_dangerous_delta matchedPackage = @vtj/pro@0.18.13 matchedIdentity = npm:QHZ0ai9wcm8:0.18.13 similarity = 0.991 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/uni/assets/index-D_QsbzKe.jsView on unpkg

dist/assets/Editor-uPV3tKdM-CYWQH8Ar.jsView file

34patternName = private_key_rsa severity = critical line = 34 matchedText = `)},e.pr...----

Critical

Secret Pattern

RSA private key in dist/assets/Editor-uPV3tKdM-CYWQH8Ar.js

dist/assets/Editor-uPV3tKdM-CYWQH8Ar.jsView on unpkg · L34

Findings

4 Critical3 High5 Medium6 Low

CriticalCritical Secretdist/@vtj/materials/deps/@vtj/utils/index.umd.js

CriticalSecret Patterndist/@vtj/materials/deps/@vtj/utils/index.umd.js

CriticalSecret Patterndist/uni/assets/index-D_QsbzKe.js

CriticalSecret Patterndist/assets/Editor-uPV3tKdM-CYWQH8Ar.js

HighShips High Entropy Blobdist/assets/iconfont.1732169275522-D4HyIDhF.woff

HighOversized Source Filedist/__devtools__/assets/index-E3YKiktg.js

HighPrevious Version Dangerous Deltadist/uni/assets/index-D_QsbzKe.js

MediumDynamic Requiredist/@vtj/materials/deps/uni-ui/index.umd.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/@vtj/materials/deps/mockjs/mock-min.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/@vtj/materials/deps/@vtj/utils/index.umd.jsView file

Lines 1-21javascript

3 * @name @vtj/utils

4 * @author CHC chenhuachun1549@dingtalk.com

5 * @version 0.18.14

6 * @license <a href="https://vtj.pro/license.html">MIT License</a>

7 */const W="0.18.14";var it={ENV_TYPE:"local",NODE_ENV:"production"},yt=typeof global=="object"&&global&&global.Object===Object&&global;const ut=yt;var et=typeof self=="object"&&self&&

8 * @fileOverview

9 * @name asn1-1.0.js

10 * @author Kenji Urushima kenji.urushima@gmail.com

11 * @version asn1 1.0.13 (2017-Jun-02)

12 * @since jsrsasign 2.1

13 * @license <a href="https://kjur.github.io/jsrsasign/license/">MIT License</a>

14 */var B={};(typeof B.asn1>"u"||!B.asn1)&&(B.asn1={}),B.asn1.ASN1Util=new function(){this.integerToByteHex=function(e){var t=e.toString(16);return t.length%

15 * numeral.js

16 * version : 2.0.6

17 * author : Adam Draper

18 * license : MIT

19 * http://adamwdraper.github.com/Numeral-js/

Long lines were clipped for display.

dist/@vtj/materials/deps/mockjs/mock-min.jsView file

Lines 1-10javascript

1!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.Mock=

dist/@vtj/materials/deps/uni-ui/index.umd.jsView file

Lines 1-2javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("@dcloudio/uni-h5"),require("vue"),require("@dcloudio/uni-app")):"function"==typeof define&&define.amd?

dist/assets/iconfont.1732169275522-D4HyIDhF.woffView file

•path = dist/assets/iconfont.1732169275522-D4HyIDhF.woff kind = high_entropy_blob sizeBytes = 21212 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/iconfont.1732169275522-D4HyIDhF.woffView on unpkg

dist/__devtools__/assets/index-E3YKiktg.jsView file

•path = dist/__devtools__/assets/index-E3YKiktg.js kind = oversized_source_file sizeBytes = 3172785 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/__devtools__/assets/index-E3YKiktg.jsView on unpkg

dist/uni/assets/index-D_QsbzKe.jsView file

Lines 15-55javascript

15`)+"var __t, __p = ''"+(o?", __e = _.escape":"")+(u?`, __j = Array.prototype.join;

16function print() { __p += __j.call(arguments, '') }

17`:`;

18`)+h+`return __p

dist/assets/Editor-uPV3tKdM-CYWQH8Ar.jsView file

34patternName = private_key_rsa severity = critical line = 34 matchedText = `)},e.pr...----

Critical

Secret Pattern

RSA private key in dist/assets/Editor-uPV3tKdM-CYWQH8Ar.js

dist/assets/Editor-uPV3tKdM-CYWQH8Ar.jsView on unpkg · L34