registry / @yahoo/uds / 3.163.1

@yahoo/uds@3.163.1

Yahoo Universal System

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,113 file(s), 12.3 MB of source, external domains: config.uds.build, configurator-git-beta-yahoo-design.vercel.app, rolldown.rs, s.yimg.com, staging.config.uds.build, tailwindcss.com, www.w3.org

Oversized source lightweight scan

dist/tailwind-internal/dist/vendor/tailwindcss/peers/index.js4.29 MB file, sampled 256 KB

FilesystemChildProcessEvalDynamicRequireObfuscatedHighEntropyStrings

dist/uds/generated/tailwindPurge.cjs4.57 MB file, sampled 256 KB

HighEntropyStrings

dist/uds/generated/tailwindPurge.js4.57 MB file, sampled 256 KB

HighEntropyStrings

generated/tailwindPurge.ts4.55 MB file, sampled 256 KB

Minified

Source & flagged code

7 flagged

dist/cli/dist/utils/analytics.cjsView file

Lines 1-22javascript

2require("../../../_virtual/_rolldown/runtime.cjs");

3let node_child_process = require("node:child_process");

4//#region ../cli/dist/utils/analytics.mjs

High

Child Process

Package source references child process execution.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

6async function trackEvent(eventName, eventParams) {

7 try {

8 let userEmail = "unknown";

9 if (process.env.CI) userEmail = "CI";

10 else try {

11 userEmail = (0, node_child_process.execSync)("git config user.email", {

12 encoding: "utf8",

13 stdio: "pipe"

14 }).trim();

15 } catch {}

16 const team = process.env.UDS_TEAM_SLUG;

17 const request = new Request("https://config.uds.build/api/cli-analytics", {

18 method: "POST",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

19 body: JSON.stringify({

20 userEmail,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

21 team,

22 eventName,

uds.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// Bootstrap for CLI - runs the built CLI from dist

3import { fileURLToPath } from 'url';

4import path from 'path';

5import packageJson from '@yahoo/uds/package.json' with { type: 'json' };

6import updateNotifier from 'simple-update-notifier';

dist/tailwind-internal/dist/vendor/tailwindcss/src/lib/cacheInvalidation.jsView file

Lines 1-36javascript

1import crypto from 'crypto'

2import * as sharedState from './sharedState'

4/**

5 * Calculate the hash of a string.

6 *

7 * This doesn't need to be cryptographically secure or

8 * anything like that since it's used only to detect

generated/tailwindPurge.tsView file

•path = generated/tailwindPurge.ts kind = oversized_source_file sizeBytes = 4766959 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

generated/tailwindPurge.tsView on unpkg

dist/cli/commands/sync.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yahoo/uds@3.162.2 matchedIdentity = npm:QHlhaG9vL3Vkcw:3.162.2 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/sync.cjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/cli/dist/utils/analytics.cjsView file

2require("../../../_virtual/_rolldown/runtime.cjs"); L3: let node_child_process = require("node:child_process"); L4: //#region ../cli/dist/utils/analytics.mjs

High

Child Process

Package source references child process execution.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

2require("../../../_virtual/_rolldown/runtime.cjs"); L3: let node_child_process = require("node:child_process"); L4: //#region ../cli/dist/utils/analytics.mjs ... L8: let userEmail = "unknown"; L9: if (process.env.CI) userEmail = "CI"; L10: else try { ... L16: const team = process.env.UDS_TEAM_SLUG; L17: const request = new Request("https://config.uds.build/api/cli-analytics", { L18: method: "POST",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

uds.jsView file

19L20: await import(cliPath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

uds.jsView on unpkg · L19

dist/tailwind-internal/dist/vendor/tailwindcss/src/lib/cacheInvalidation.jsView file

16* L17: * See https://github.com/nodejs/node/issues/40455 L18: *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tailwind-internal/dist/vendor/tailwindcss/src/lib/cacheInvalidation.jsView on unpkg · L16

generated/tailwindPurge.tsView file

•path = generated/tailwindPurge.ts kind = oversized_source_file sizeBytes = 4766959 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

generated/tailwindPurge.tsView on unpkg

dist/cli/commands/sync.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/sync.cjsView on unpkg

Findings

6 High4 Medium7 Low

HighChild Processdist/cli/dist/utils/analytics.cjs

HighShell

HighSame File Env Network Executiondist/cli/dist/utils/analytics.cjs

HighSandbox Evasion Gated Capabilitydist/cli/dist/utils/analytics.cjs

HighOversized Source Filegenerated/tailwindPurge.ts

HighPrevious Version Dangerous Deltadist/cli/commands/sync.cjs

MediumDynamic Requireuds.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/tailwind-internal/dist/vendor/tailwindcss/src/lib/cacheInvalidation.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/cli/dist/utils/analytics.cjsView file

Lines 1-22javascript

2require("../../../_virtual/_rolldown/runtime.cjs");

3let node_child_process = require("node:child_process");

4//#region ../cli/dist/utils/analytics.mjs

High

Child Process

Package source references child process execution.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

6async function trackEvent(eventName, eventParams) {

7 try {

8 let userEmail = "unknown";

9 if (process.env.CI) userEmail = "CI";

10 else try {

11 userEmail = (0, node_child_process.execSync)("git config user.email", {

12 encoding: "utf8",

13 stdio: "pipe"

14 }).trim();

15 } catch {}

16 const team = process.env.UDS_TEAM_SLUG;

17 const request = new Request("https://config.uds.build/api/cli-analytics", {

18 method: "POST",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

19 body: JSON.stringify({

20 userEmail,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2

21 team,

22 eventName,

uds.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// Bootstrap for CLI - runs the built CLI from dist

3import { fileURLToPath } from 'url';

4import path from 'path';

5import packageJson from '@yahoo/uds/package.json' with { type: 'json' };

6import updateNotifier from 'simple-update-notifier';

dist/tailwind-internal/dist/vendor/tailwindcss/src/lib/cacheInvalidation.jsView file

Lines 1-36javascript

1import crypto from 'crypto'

2import * as sharedState from './sharedState'

4/**

5 * Calculate the hash of a string.

6 *

7 * This doesn't need to be cryptographically secure or

8 * anything like that since it's used only to detect

generated/tailwindPurge.tsView file

•path = generated/tailwindPurge.ts kind = oversized_source_file sizeBytes = 4766959 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

generated/tailwindPurge.tsView on unpkg

dist/cli/commands/sync.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/sync.cjsView on unpkg