registry / @vue-ui-kit/ant / 2.5.11

@vue-ui-kit/ant@2.5.11

⚠ Under review

Vue3 UI Kit based on Ant Design

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 22 file(s), 897 KB of source, external domains: github.com, www.w3.org

Source & flagged code

2 flagged

dist/cjs/index.jsView file

Lines 1-17javascript

1Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),s=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},c=(n,r,a)=>(a=n==null?{}:e(i(n)),s(r||!n||!n.__esModule?t(a,` ...

2`)>-1?a+=`"${o.replace(/"/g,`""`)}"`:a+=o:o==null?a+=``:a+=o;t!==n-1&&(a+=`

3`)}return a}function g(e,t,n=[]){let r=0,i=[];return e.forEach((a,o)=>{o===0?i.push(1):(n.reduce((e,t)=>`${e}${a[t

4`){s(e+1);continue}let o=this.ctx.measureText(r).width;if(a+o>t&&i.length>0){s(i[i.length-1].sourceIndex+1),i.push({char:r,sourceIndex:e}),a=o;continue}i.push({char:r,sourceIndex:e}),a+=o}return(i.length>0||r.length===0)&&s(n.length),r}buildEllipsisLine(e,t,n){let r=e.flatMap(e=>e.items),i=r.map(e=>e.char).join(``),{_text:a,ellipsis:o}=this.handleEllipsis(i,t,n,this.ctx.font),s=o?a.slice(0,-3):a,c=[];for(let e=0;e<s.length;e++){let t=r[e];if(!t)break;c.push({char:t.char,sourceIndex:t.sourceIndex})}return o&&c.push({char:`.`,sourceIndex:-1,ellipsis:!0},{char:`.`,sourceIndex:-1,ellipsis:!0},{cha ...

5`);for(let e of i){if(e===``){r.push(``);continue}let n=e.split(``),i=``;for(let e of n){let n=i+e;this.ctx.measureText(n).width<=t?i=n:i?(r.push(i),i=

6`,de=`<svg t="1722595535853" class="icon" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-id="4551" width="32" height="32"><path d="M640 128H384c-170.496 0-256 85.504-256 256v256c0 170.496 85.504 256 256 256h256c170.496 0 256-85.504 256-256V384c0-170.496-85.504-256-256-256z m67.584 302.592c-2.048 4.608-4.608 8.704-8.192 12.288L506.88 634.88c-3.584 3.584-7.68 6.144-12.288 8.192-4.608 2.048-9.728 3.072-14.848 3.072s-10.24-1.024-14.848-3.072c-4.608-2.048-8.704-4.608-12.288-8.192l-96.256-96.256c-3.584-3.584-6.144-7.68-8.192-12.288-2.048-4.608-3.072-9.728-3.072-14.848 0-2 ...

7`,fe=`<svg t="1724122044148" class="icon" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-id="4551" width="32" height="32"><path d="M707.648 401.28L489.28 560.704l22.656 30.976 22.656-30.976L316.16 401.216q-3.072-2.24-6.464-3.84-3.456-1.536-7.104-2.432-3.712-0.896-7.488-1.088-3.776-0.128-7.488 0.448-3.776 0.64-7.296 1.92-3.584 1.28-6.784 3.2-3.2 1.984-6.016 4.544-2.816 2.56-5.056 5.632-2.176 3.072-3.84 6.464-1.536 3.456-2.432 7.104-0.896 3.712-1.088 7.488-0.128 3.776 0.448 7.488 0.64 3.776 1.92 7.296 1.28 3.584 3.2 6.784 1.984 3.2 4.544 6.016 2.56 2.752 5.632 4.992l2 ...

8`,pe=`<svg t="1755138507987" class="icon" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-id="5079" width="200" height="200"><path d="M512 938.688a42.688 42.688 0 0 1-35.072-18.432l-192-277.312A42.56 42.56 0 0 1 320 576h384a42.752 42.752 0 0 1 35.072 66.944l-192 277.312a42.688 42.688 0 0 1-35.072 18.432" fill="currentColor" p

9`,me=pe.replace(`fill="currentColor" p-id="2016"`,`fill="#bec4c7" p-id="2016"`),he=pe.replace(`fill="currentColor" p-id="2015"`,`fill="#bec4c7" p-id="2015"`);class ge{constructor(e){n(this,`ctx`),n(this,`list`,[{name:`loading`,configName:`LOADING_ICON_SVG`,configColorName:`LOADING_ICON_COLOR`,svg:`<svg

10`,color:`#4E5969`},{name:`expand`,configName:`EXPAND_ICON_SVG`,configColorName:`EXPAND_ICON_COLOR`,svg:R,color:`#4E5969`},{name:`shrink`,configName:`SHRINK_ICON_SVG`,configColorName:`SHRINK_ICON_COLOR`,svg:fe,color:`#4E5969`},{name:`checkbox-uncheck`,configName:`CHECKBOX_UNCHECK_SVG`,configColorName:`CHECKBOX_UNCHECK_COLOR`,svg:`<svg t="1722595639920" class="icon" viewBox="0 0 1024 1024" version=

11`,color:``},{name:`checkbox-check`,configName:`CHECKBOX_CHECK_SVG`,configColorName:`CHECKBOX_COLOR`,svg:de,color:`rgb(82,146,247)`},{name:`checkbox-indeterminate`,configName:`CHECKBOX_INDETERMINATE_SVG`,configColorName:`CHECKBOX_COLOR`,svg:`<svg t="1722595280953" class="icon" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-id="4394"

12`,color:`rgb(82,146,247)`},{name:`checkbox-check-disabled`,configName:`CHECKBOX_CHECK_DISABLED_SVG`,svg:de,color:`#DDE0EA`},{name:`checkbox-disabled`,configName:`CHECKBOX_DISABLED_SVG`,configColorName:`CHECKBOX_DISABLED_COLOR`,svg:`<svg t="1722595946663" class="icon" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-

13`,color:`#F1F2F4`},{name:`icon-edit`,configName:`ICON_EDIT_SVG`,configColorName:`ICON_EDIT_COLOR`,svg:`<svg t="1744798692576" class="icon" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-id="6606" width="200" height="200"><

14`,color:`#4E5969`},{name:`icon-select`,configName:`ICON_SELECT_SVG`,configColorName:`ICON_SELECT_COLOR`,svg:fe,color:`#4E5969`},{name:`sort-asc`,configName:`SORT_ASC_ICON_SVG`,configColorName:`SORT_ICON_COLOR`,svg:me,color:`rgb(82,146,247)`},{name:`sort-desc`,configName:`SORT_DESC_ICON_SVG`,configColorName:`SORT_ICON_COLOR`,svg:he,color:`rgb(82,146,247)`},{name:`sort-default`,configName:`SORTABLE_ICON_SVG`,svg:pe,color:`#bec4c7`},{name:`

15`,color:`#4E5969`}]),n(this,`icons`,new Map),this.ctx=e,this.init()}async init(){let e=[];for(let t=0;t<this.list.length;t++){let n=this.list[t],r=n.color,i=n.svg;if(n.configColorName){let e=this.ctx.config[n.configColorName];e&&(r=e)}if(n.configName){let e=this.ctx.config[n.configName];e&&(i=e)}let a=this.createImageFromSVG(i,r).then(e=>{this.icons.set(n.name,e)});e.push(a)}for(let t=0;t<this.ctx.config.ICONS.length;t++){let n=this.ctx.config.ICONS[t],r=n.color,i=this.createImageFromSVG(n.svg,r,n.isBlob).then(e=>{this.icons.set(n.name,e)});e.push(i)}await Promise.all(e),this.ctx.emit(`draw`)} ...

16`+r,this.inputEl.selectionStart=this.inputEl.selectionEnd=t+1,this.autoSize();return}if(e.code===`Tab`&&this.ctx.editing){if(e.preventDefault(),this.doneEdit(),e.shiftKey){this

17`,t.appendChild(this.loadingEl),this.countEl=document.createElement(`span`),this.countEl.className=`e-virt-table-finder-bar-count`;let n=document.createElement(`div`);return n.className=`e-virt-table-finder-bar-nav`,this.prevBtn=

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/cjs/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cjs/index.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/cjs/index.jsView file

3contains invisible/control Unicode U+200B (zero width space) `)}return a}function g(e,t,n=[]){let r=0,i=[];return e.forEach((a,o)=>{o===0?i.push(1):(n.reduce((e,t)=>`${e}${a[t]??``}`,``)||a[t])===(n.reduce((t,n)=>`${t}${e[o-1][n]??``}`,``)||e[o-1][t])?(i[r]+=1,i.push(0)):(i.push(1),r=o)}),i}function

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/cjs/index.jsView on unpkg · L3

•Trigger-reachable chain: manifest.main -> dist/cjs/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cjs/index.jsView on unpkg

Findings

2 Critical1 Medium5 Low

CriticalTrojan Source Unicodedist/cjs/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/cjs/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

2 flagged

dist/cjs/index.jsView file

Lines 1-17javascript

2`)>-1?a+=`"${o.replace(/"/g,`""`)}"`:a+=o:o==null?a+=``:a+=o;t!==n-1&&(a+=`

3`)}return a}function g(e,t,n=[]){let r=0,i=[];return e.forEach((a,o)=>{o===0?i.push(1):(n.reduce((e,t)=>`${e}${a[t

5`);for(let e of i){if(e===``){r.push(``);continue}let n=e.split(``),i=``;for(let e of n){let n=i+e;this.ctx.measureText(n).width<=t?i=n:i?(r.push(i),i=

16`+r,this.inputEl.selectionStart=this.inputEl.selectionEnd=t+1,this.autoSize();return}if(e.code===`Tab`&&this.ctx.editing){if(e.preventDefault(),this.doneEdit(),e.shiftKey){this

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/cjs/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cjs/index.jsView on unpkg