registry  /  @yahoo/uds  /  3.162.2

@yahoo/uds@3.162.2

Yahoo Universal System

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1,109 file(s), 12.3 MB of source, external domains: config.uds.build, configurator-git-beta-yahoo-design.vercel.app, rolldown.rs, s.yimg.com, staging.config.uds.build, tailwindcss.com, www.w3.org
Oversized source lightweight scan
dist/tailwind-internal/dist/vendor/tailwindcss/peers/index.js4.29 MB file, sampled 256 KB
FilesystemChildProcessEvalDynamicRequireObfuscatedHighEntropyStrings
dist/uds/generated/tailwindPurge.cjs4.57 MB file, sampled 256 KB
HighEntropyStrings
dist/uds/generated/tailwindPurge.js4.57 MB file, sampled 256 KB
HighEntropyStrings
generated/tailwindPurge.ts4.55 MB file, sampled 256 KB
Minified

Source & flagged code

6 flagged · loading source
dist/cli/dist/utils/analytics.cjsView file
2require("../../../_virtual/_rolldown/runtime.cjs"); L3: let node_child_process = require("node:child_process"); L4: //#region ../cli/dist/utils/analytics.mjs
High
Child Process

Package source references child process execution.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2
2require("../../../_virtual/_rolldown/runtime.cjs"); L3: let node_child_process = require("node:child_process"); L4: //#region ../cli/dist/utils/analytics.mjs ... L8: let userEmail = "unknown"; L9: if (process.env.CI) userEmail = "CI"; L10: else try { ... L16: const team = process.env.UDS_TEAM_SLUG; L17: const request = new Request("https://config.uds.build/api/cli-analytics", { L18: method: "POST",
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2
2require("../../../_virtual/_rolldown/runtime.cjs"); L3: let node_child_process = require("node:child_process"); L4: //#region ../cli/dist/utils/analytics.mjs ... L8: let userEmail = "unknown"; L9: if (process.env.CI) userEmail = "CI"; L10: else try { ... L16: const team = process.env.UDS_TEAM_SLUG; L17: const request = new Request("https://config.uds.build/api/cli-analytics", { L18: method: "POST", L19: body: JSON.stringify({ L20: userEmail,
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/dist/utils/analytics.cjsView on unpkg · L2
uds.jsView file
19L20: await import(cliPath);
Medium
Dynamic Require

Package source references dynamic require/import behavior.

uds.jsView on unpkg · L19
dist/tailwind-internal/dist/vendor/tailwindcss/src/lib/cacheInvalidation.jsView file
16* L17: * See https://github.com/nodejs/node/issues/40455 L18: *
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/tailwind-internal/dist/vendor/tailwindcss/src/lib/cacheInvalidation.jsView on unpkg · L16
generated/tailwindPurge.tsView file
•path = generated/tailwindPurge.ts kind = oversized_source_file sizeBytes = 4766959 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

generated/tailwindPurge.tsView on unpkg

Findings

5 High4 Medium7 Low
HighChild Processdist/cli/dist/utils/analytics.cjs
HighShell
HighSame File Env Network Executiondist/cli/dist/utils/analytics.cjs
HighSandbox Evasion Gated Capabilitydist/cli/dist/utils/analytics.cjs
HighOversized Source Filegenerated/tailwindPurge.ts
MediumDynamic Requireuds.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowWeak Cryptodist/tailwind-internal/dist/vendor/tailwindcss/src/lib/cacheInvalidation.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings