registry / @webwriter/code / 3.0.5

@webwriter/code@3.0.5

Write and run code as a code cell. Supports several languages (HTML, JavaScript/TypeScript, Python, Java, WebAssembly).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 5.76 MB of source, external domains: bugs.webkit.org, cdn.jsdelivr.net, codemirror.net, developer.mozilla.org, en.wikipedia.org, github.com, www.w3.org

Oversized source lightweight scan

dist/widgets/ww-code-java.js10.3 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsUrlStringscodemirror.net

dist/widgets/ww-code-typescript.js9.81 MB file, sampled 256 KB

ChildProcessDynamicRequireHighEntropyStringsUrlStringswww.w3.org

dist/widgets/ww-code-webassembly.js2.66 MB file, sampled 256 KB

ChildProcessHighEntropyStringsUrlStringscodemirror.net

Source & flagged code

9 flagged

package.jsonView file

Lines 42-82json

42 "widget-lang-tr",

43 "widget-lang-uk",

44 "widget-lang-pt-BR",

45 "widget-lang-ko",

46 "widget-lang-ja",

47 "widget-lang-id",

48 "widget-lang-zh-hans",

49 "widget-lang-zh-hant"

50 ],

51 "license": "MIT",

52 "author": "",

53 "contributors": [

54 "Erik Viere",

55 "Jorik van Genuchten"

56 ],

57 "scripts": {

58 "prepublishOnly": "npx @webwriter/build",

59 "dev": "npx @webwriter/build dev",

60 "localize": "lit-localize extract && npx @webwriter/build localize && lit-localize build",

61 "format": "prettier --write .",

62 "postinstall": "patch-package"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 },

64 "dependencies": {

65 "@codemirror/autocomplete": ">=6.10.2 <7.0.0-0",

66 "@codemirror/commands": ">=6.3.0 <7.0.0-0",

67 "@codemirror/lang-css": ">=6.2.1 <7.0.0-0",

68 "@codemirror/lang-html": ">=6.4.6 <7.0.0-0",

69 "@codemirror/lang-java": "^6.0.2",

70 "@codemirror/lang-javascript": ">=6.2.1 <7.0.0-0",

71 "@codemirror/lang-python": ">=6.1.3 <7.0.0-0",

72 "@codemirror/lang-wast": ">=6.0.1 <7.0.0-0",

73 "@codemirror/language": ">=6.9.1 <7.0.0-0",

74 "@codemirror/search": ">=6.5.4 <7.0.0-0",

75 "@codemirror/state": ">=6.3.0 <7.0.0-0",

76 "@codemirror/theme-one-dark": "^6.1.3",

77 "@codemirror/view": ">=6.21.3 <7.0.0-0",

78 "@lezer/highlight": "^1.2.1",

79 "@lit/localize": "^0.12.2",

80 "@replit/codemirror-indentation-markers": ">=6.5.0 <7.0.0-0",

81 "@shoelace-style/shoelace": ">=2.9.0 <3.0.0-0",

82 "@webwriter/lit": "^2.0.0",

dist/widgets/ww-code-javascript.jsView file

23194// inline-worker:/[redacted].worker.ts L23195: var javascript_worker_default = 'var p=new Map,g=0;function o(e,i=!1){if(e===null)return{type:"null"};if(e===void 0)return{type:"undefined"};if(typeof e=="string")return{type:"stri... L23196:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/widgets/ww-code-javascript.jsView on unpkg · L23194

src/java/teavm/compiler.wasm-runtime.jsView file

Lines 1-2javascript

1let n=new Map;let e=null;let i=/.+:wasm-function\[[0-9]+]:0x([0-9a-f]+).*/;let W=function(e){let t=n.get(e);if

src/java/teavm/compiler.wasm.tiffView file

•path = src/java/teavm/compiler.wasm.tiff kind = wasm_module sizeBytes = 4299273 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/java/teavm/compiler.wasm.tiffView on unpkg

src/java/teavm/update-runtime/update.shView file

•path = src/java/teavm/update-runtime/update.sh kind = build_helper sizeBytes = 1075 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/java/teavm/update-runtime/update.shView on unpkg

src/java/teavm/compile-classlib-teavm.bin.tiffView file

•path = src/java/teavm/compile-classlib-teavm.bin.tiff kind = high_entropy_blob sizeBytes = 200625 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/java/teavm/compile-classlib-teavm.bin.tiffView on unpkg

•path = src/java/teavm/compile-classlib-teavm.bin.tiff kind = compressed_blob sizeBytes = 200625 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

src/java/teavm/compile-classlib-teavm.bin.tiffView on unpkg

dist/widgets/ww-code-webassembly.jsView file

•path = dist/widgets/ww-code-webassembly.js kind = oversized_source_file sizeBytes = 2794096 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/widgets/ww-code-webassembly.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = patch-package

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/widgets/ww-code-javascript.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/widgets/ww-code-javascript.jsView on unpkg · L23194

src/java/teavm/compiler.wasm-runtime.jsView file

1let n=new Map;let e=null;let i=/.+:wasm-function\[[0-9]+]:0x([0-9a-f]+).*/;let W=function(e){let t=n.get(e);if(typeof t==="undefined"){t=new Function("return "+e+";");n.set(e,t)}re...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/java/teavm/compiler.wasm-runtime.jsView on unpkg · L1

src/java/teavm/compiler.wasm.tiffView file

•path = src/java/teavm/compiler.wasm.tiff kind = wasm_module sizeBytes = 4299273 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/java/teavm/compiler.wasm.tiffView on unpkg

src/java/teavm/update-runtime/update.shView file

•path = src/java/teavm/update-runtime/update.sh kind = build_helper sizeBytes = 1075 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/java/teavm/update-runtime/update.shView on unpkg

src/java/teavm/compile-classlib-teavm.bin.tiffView file

•path = src/java/teavm/compile-classlib-teavm.bin.tiff kind = high_entropy_blob sizeBytes = 200625 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/java/teavm/compile-classlib-teavm.bin.tiffView on unpkg

•path = src/java/teavm/compile-classlib-teavm.bin.tiff kind = compressed_blob sizeBytes = 200625 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

src/java/teavm/compile-classlib-teavm.bin.tiffView on unpkg

dist/widgets/ww-code-webassembly.jsView file

•path = dist/widgets/ww-code-webassembly.js kind = oversized_source_file sizeBytes = 2794096 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/widgets/ww-code-webassembly.jsView on unpkg

Findings

3 High8 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobsrc/java/teavm/compile-classlib-teavm.bin.tiff

HighOversized Source Filedist/widgets/ww-code-webassembly.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/java/teavm/compiler.wasm-runtime.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulesrc/java/teavm/compiler.wasm.tiff

MediumShips Build Helpersrc/java/teavm/update-runtime/update.sh

MediumShips Compressed Blobsrc/java/teavm/compile-classlib-teavm.bin.tiff

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/widgets/ww-code-javascript.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 42-82json

42 "widget-lang-tr",

43 "widget-lang-uk",

44 "widget-lang-pt-BR",

45 "widget-lang-ko",

46 "widget-lang-ja",

47 "widget-lang-id",

48 "widget-lang-zh-hans",

49 "widget-lang-zh-hant"

50 ],

51 "license": "MIT",

52 "author": "",

53 "contributors": [

54 "Erik Viere",

55 "Jorik van Genuchten"

56 ],

57 "scripts": {

58 "prepublishOnly": "npx @webwriter/build",

59 "dev": "npx @webwriter/build dev",

60 "localize": "lit-localize extract && npx @webwriter/build localize && lit-localize build",

61 "format": "prettier --write .",

62 "postinstall": "patch-package"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 },

64 "dependencies": {

65 "@codemirror/autocomplete": ">=6.10.2 <7.0.0-0",

66 "@codemirror/commands": ">=6.3.0 <7.0.0-0",

67 "@codemirror/lang-css": ">=6.2.1 <7.0.0-0",

68 "@codemirror/lang-html": ">=6.4.6 <7.0.0-0",

69 "@codemirror/lang-java": "^6.0.2",

70 "@codemirror/lang-javascript": ">=6.2.1 <7.0.0-0",

71 "@codemirror/lang-python": ">=6.1.3 <7.0.0-0",

72 "@codemirror/lang-wast": ">=6.0.1 <7.0.0-0",

73 "@codemirror/language": ">=6.9.1 <7.0.0-0",

74 "@codemirror/search": ">=6.5.4 <7.0.0-0",

75 "@codemirror/state": ">=6.3.0 <7.0.0-0",

76 "@codemirror/theme-one-dark": "^6.1.3",

77 "@codemirror/view": ">=6.21.3 <7.0.0-0",

78 "@lezer/highlight": "^1.2.1",

79 "@lit/localize": "^0.12.2",

80 "@replit/codemirror-indentation-markers": ">=6.5.0 <7.0.0-0",

81 "@shoelace-style/shoelace": ">=2.9.0 <3.0.0-0",

82 "@webwriter/lit": "^2.0.0",

dist/widgets/ww-code-javascript.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/widgets/ww-code-javascript.jsView on unpkg · L23194

src/java/teavm/compiler.wasm-runtime.jsView file

Lines 1-2javascript

1let n=new Map;let e=null;let i=/.+:wasm-function\[[0-9]+]:0x([0-9a-f]+).*/;let W=function(e){let t=n.get(e);if

src/java/teavm/compiler.wasm.tiffView file

•path = src/java/teavm/compiler.wasm.tiff kind = wasm_module sizeBytes = 4299273 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/java/teavm/compiler.wasm.tiffView on unpkg

src/java/teavm/update-runtime/update.shView file

•path = src/java/teavm/update-runtime/update.sh kind = build_helper sizeBytes = 1075 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/java/teavm/update-runtime/update.shView on unpkg

src/java/teavm/compile-classlib-teavm.bin.tiffView file

•path = src/java/teavm/compile-classlib-teavm.bin.tiff kind = high_entropy_blob sizeBytes = 200625 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/java/teavm/compile-classlib-teavm.bin.tiffView on unpkg

•path = src/java/teavm/compile-classlib-teavm.bin.tiff kind = compressed_blob sizeBytes = 200625 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

src/java/teavm/compile-classlib-teavm.bin.tiffView on unpkg

dist/widgets/ww-code-webassembly.jsView file

•path = dist/widgets/ww-code-webassembly.js kind = oversized_source_file sizeBytes = 2794096 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/widgets/ww-code-webassembly.jsView on unpkg