registry / @zuplo/core / 6.72.1

@zuplo/core@6.72.1

⚠ Under review

This module contains the type definitions for the Zuplo core module.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 536 KB of source, external domains: developer.mozilla.org, dotenvx.com, github.com, handlebarsjs.com, www.w3.org

Oversized source lightweight scan

customer.cli.minified.js4.80 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsObfuscatedHighEntropyStringsMinifiedUrlStringsdeveloper.mozilla.orghandlebarsjs.comwww.w3.org

index.minified.js4.81 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsdeveloper.mozilla.orgdotenvx.comgithub.comhandlebarsjs.comwww.w3.org

Source & flagged code

3 flagged

zeno.jsView file

Lines 4-29javascript

4 *

5 * This software and associated documentation files (the "Software") is intended to be used

6 * only by Zuplo customers solely to develop and test applications that will be deployed

7 * to Zuplo hosted services. You and others in your organization may use these files on your

8 * Development Devices solely for the above stated purpose.

9 *

10 * Outside of uses stated above, no license is granted for any other purpose including

11 * without limitation the rights to use, copy, modify, merge, publish, distribute,

12 * sublicense, host, and/or sell copies of the Software.

13 *

14 * The software may include third party components with separate legal notices or governed by

15 * other agreements, as described in licenses either embedded in or accompanying the Software.

16 *

17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,

18 * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR

19 * PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE

20 * FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR

21 * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

22 * DEALINGS IN THE SOFTWARE.

23 *--------------------------------------------------------------------------------------------*/

26`),nt=$.encode("*"),ot=$.encode("$");function oe(t){let e=[nt,$.encode(t.length.toString()),J];for(let r of t){let o=r instanceof Uint8Array?r:$.encode(r.

27`);#n=new Set([..."[]{}:,/",...this.#t]);#e;#r;#s;constructor(e){this.#e=`${e}`,this.#r=this.#e.length,this.#s=this.#l()}parse(){let e=this.#o(),r=this.#i(e),{done:o,value:s}=this.#s.next();if(!o)throw new SyntaxError(I(s));return r}#o(){let{done:e,value:r}=this.#s.next();if(e)throw new SyntaxError("Cannot parse JSONC: unexpected end of JSONC input");return r}*#l(){for(let e=0;e<this.#r;e++)if(!this.#t.has(this.#e[e])){if(this.#e[e]==="/"&&this.#e[e+1]==="*"){e+=2;let r=!1;for(;e<this.#r;e++)if(this.#e[e]==="*"&&this.#e[e+1]==="/"){r=!0;break}if(!r)throw new SyntaxError("Cannot parse JSONC: un ...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

zeno.jsView on unpkg · L24

Medium

Dynamic Require

Package source references dynamic require/import behavior.

zeno.jsView on unpkg · L25

28`||this.#e[e]==="\r");e++);continue}switch(this.#e[e]){case"{":yield{type:"BeginObject",position:e};break;case"}":yield{type:"EndObject",position:e};break;case"[":yield{type:"BeginArray",position:e};break;case"]":yield{type:"EndArray"

Long lines were clipped for display.

index.minified.jsView file

•path = index.minified.js kind = oversized_source_file sizeBytes = 5040605 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.minified.jsView on unpkg

Source & flagged code

3 flagged · loading source

zeno.jsView file

24L25: var Ue=Object.defineProperty;var n=(t,e)=>Ue(t,"name",{value:e,configurable:!0});import{scheduler as Ge}from"node:timers/promises";Object.defineProperty(globalThis,"scheduler",{val... L26: `),nt=$.encode("*"),ot=$.encode("$");function oe(t){let e=[nt,$.encode(t.length.toString()),J];for(let r of t){let o=r instanceof Uint8Array?r:$.encode(r.toString());e.push(ot,$.en... L27: `);#n=new Set([..."[]{}:,/",...this.#t]);#e;#r;#s;constructor(e){this.#e=`${e}`,this.#r=this.#e.length,this.#s=this.#l()}parse(){let e=this.#o(),r=this.#i(e),{done:o,value:s}=this....

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

zeno.jsView on unpkg · L24

25var Ue=Object.defineProperty;var n=(t,e)=>Ue(t,"name",{value:e,configurable:!0});import{scheduler as Ge}from"node:timers/promises";Object.defineProperty(globalThis,"scheduler",{val... L26: `),nt=$.encode("*"),ot=$.encode("$");function oe(t){let e=[nt,$.encode(t.length.toString()),J];for(let r of t){let o=r instanceof Uint8Array?r:$.encode(r.toString());e.push(ot,$.en... L27: `);#n=new Set([..."[]{}:,/",...this.#t]);#e;#r;#s;constructor(e){this.#e=`${e}`,this.#r=this.#e.length,this.#s=this.#l()}parse(){let e=this.#o(),r=this.#i(e),{done:o,value:s}=this....

Medium

Dynamic Require

Package source references dynamic require/import behavior.

zeno.jsView on unpkg · L25

index.minified.jsView file

•path = index.minified.js kind = oversized_source_file sizeBytes = 5040605 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.minified.jsView on unpkg

Findings

1 Critical1 High4 Medium5 Low

CriticalCredential Exfiltrationzeno.js

HighOversized Source Fileindex.minified.js

MediumDynamic Requirezeno.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

zeno.jsView file

Lines 4-29javascript

4 *

5 * This software and associated documentation files (the "Software") is intended to be used

6 * only by Zuplo customers solely to develop and test applications that will be deployed

7 * to Zuplo hosted services. You and others in your organization may use these files on your

8 * Development Devices solely for the above stated purpose.

9 *

10 * Outside of uses stated above, no license is granted for any other purpose including

11 * without limitation the rights to use, copy, modify, merge, publish, distribute,

12 * sublicense, host, and/or sell copies of the Software.

13 *

14 * The software may include third party components with separate legal notices or governed by

15 * other agreements, as described in licenses either embedded in or accompanying the Software.

16 *

17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,

18 * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR

19 * PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE

20 * FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR

21 * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

22 * DEALINGS IN THE SOFTWARE.

23 *--------------------------------------------------------------------------------------------*/

26`),nt=$.encode("*"),ot=$.encode("$");function oe(t){let e=[nt,$.encode(t.length.toString()),J];for(let r of t){let o=r instanceof Uint8Array?r:$.encode(r.

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

zeno.jsView on unpkg · L24

Medium

Dynamic Require

Package source references dynamic require/import behavior.

zeno.jsView on unpkg · L25

Long lines were clipped for display.

index.minified.jsView file

•path = index.minified.js kind = oversized_source_file sizeBytes = 5040605 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.minified.jsView on unpkg