@wecode-team/we0-cms@1.3.4

A CMS component for React applications with shadcn/ui

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEval

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.91 MB of source, external domains: stuk.github.io, www.w3.org

Source & flagged code

7 flagged

dist/index.jsView file

10patternName = private_key_rsa severity = critical line = 10 matchedText = var At={...u))}

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L10

10patternName = private_key_rsa severity = critical line = 10 matchedText = var At={...u))}

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L10

1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("react"),t=require("react/jsx-runtime"),n=require("react-dom"),r=require("react-dom/client"),i=req... L2: /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.[redacted]-helpers/LICENSE */ L3: var e,t,n="function"==typeof Symbol?Symbol:{},r=n.iterator||"@@iterator",i=n.toStringTag||"@@toStringTag";function o(n,r,i,o){var c=r&&r.prototype instanceof s?r:s,l=Object.create(... ... L9: */ L10: var At={xmlns:"http://www.w3.org/2000/svg",width:24,height:24,viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:2,strokeLinecap:"round",strokeLinejoin:"round"},Ot=[... L11: /*! @license DOMPurify 3.4.0 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.0/LIC... L12: /*!

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

10patternName = generic_password severity = medium line = 10 matchedText = var At={...u))}

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L10

10var At={xmlns:"http://www.w3.org/2000/svg",width:24,height:24,viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:2,strokeLinecap:"round",strokeLinejoin:"round"},Ot=[... L11: /*! @license DOMPurify 3.4.0 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.0/LIC... L12: /*!

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L10

dist/index.esm.jsView file

10patternName = private_key_rsa severity = critical line = 10 matchedText = var Hn={...c))}

Critical

Secret Pattern

RSA private key in dist/index.esm.js

dist/index.esm.jsView on unpkg · L10

10patternName = generic_password severity = medium line = 10 matchedText = var Hn={...c))}

Medium