registry / @zvoove/unity-ui / 2.35.2

@zvoove/unity-ui@2.35.2

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 4.21 MB of source, external domains: main--67c03f013fea08bb2f926e5f.chromatic.com, mui.com, ui.shadcn.com, www.figma.com, www.w3.org

Source & flagged code

4 flagged

dist/bin/cli.mjsView file

Lines 1242-1282javascript

1242 if (searchingOptions) {

1243 similar = similar.map((candidate) => `--${candidate}`);

1244 }

1245 if (similar.length > 1) {

1246 return `

1247(Did you mean one of ${similar.join(", ")}?)`;

1248 }

1249 if (similar.length === 1) {

1250 return `

1251(Did you mean ${similar[0]}?)`;

1252 }

1253 return "";

1254 }

1255 exports.suggestSimilar = suggestSimilar;

1256 }

1257});

1258

1259// node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js

1260var require_command = __commonJS({

1261 "node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js"(exports) {

1262 var EventEmitter = __require("node:events").EventEmitter;

1263 var childProcess = __require("node:child_process");

1264 var path6 = __require("node:path");

High

Child Process

Package source references child process execution.

dist/bin/cli.mjsView on unpkg · L1262

1265 var fs6 = __require("node:fs");

1266 var process2 = __require("node:process");

1267 var { Argument: Argument2, humanReadableArgName } = require_argument();

1268 var { CommanderError: CommanderError2 } = require_error();

1269 var { Help: Help2, stripColor } = require_help();

1270 var { Option: Option2, DualOptions } = require_option();

1271 var { suggestSimilar } = require_suggestSimilar();

1272 var Command2 = class _Command extends EventEmitter {

1273 /**

1274 * Initialize a new `Command`.

1275 *

1276 * @param {string} [name]

1277 */

1278 constructor(name) {

1279 super();

1280 this.commands = [];

1281 this.options = [];

1282 this.parent = null;

Lines 2095-2135javascript

2095 if (cmd.getOptionValueSource(key) !== void 0) {

2096 source = cmd.getOptionValueSource(key);

2097 }

2098 });

2099 return source;

2100 }

2101 /**

2102 * Get user arguments from implied or explicit arguments.

2103 * Side-effects: set _scriptPath if args included script. Used for default program name, and subcommand searches.

Lines 3619-3659javascript

3619 return getComponentName(a).localeCompare(getComponentName(b));

3620 });

3621 const finalContent = [themeImport, "", ...sortedExports].filter(Boolean).join("\n") + "\n";

3622 const finalContentWithEmptyLine

dist/bin/generate-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{createRequire}from"module";const require=createRequire(import.meta.url);

3var __defProp = Object.defineProperty;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/generate-skills.mjsView on unpkg · L1

4var __getOwnPropNames = Object.getOwnPropertyNames;

Source & flagged code

4 flagged · loading source

dist/bin/cli.mjsView file

1262var EventEmitter = __require("node:events").EventEmitter; L1263: var childProcess = __require("node:child_process"); L1264: var path6 = __require("node:path");

High

Child Process

Package source references child process execution.

dist/bin/cli.mjsView on unpkg · L1262

2115} L2116: const execArgv = process2.execArgv ?? []; L2117: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/bin/cli.mjsView on unpkg · L2115

3639try { L3640: execSync( L3641: `npx prettier --write "${componentDir}" --ignore-glob "**/*.md" --ignore-glob "**/*.mdx"`, L3642: { stdio: "inherit" }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/cli.mjsView on unpkg · L3639

dist/bin/generate-skills.mjsView file

1#!/usr/bin/env node L2: import{createRequire}from"module";const require=createRequire(import.meta.url); L3: var __defProp = Object.defineProperty;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/generate-skills.mjsView on unpkg · L1

Findings

3 High3 Medium5 Low

HighChild Processdist/bin/cli.mjs

HighShelldist/bin/cli.mjs

HighRuntime Package Installdist/bin/cli.mjs

MediumDynamic Requiredist/bin/generate-skills.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/bin/cli.mjsView file

Lines 1242-1282javascript

1242 if (searchingOptions) {

1243 similar = similar.map((candidate) => `--${candidate}`);

1244 }

1245 if (similar.length > 1) {

1246 return `

1247(Did you mean one of ${similar.join(", ")}?)`;

1248 }

1249 if (similar.length === 1) {

1250 return `

1251(Did you mean ${similar[0]}?)`;

1252 }

1253 return "";

1254 }

1255 exports.suggestSimilar = suggestSimilar;

1256 }

1257});

1258

1259// node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js

1260var require_command = __commonJS({

1261 "node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js"(exports) {

1262 var EventEmitter = __require("node:events").EventEmitter;

1263 var childProcess = __require("node:child_process");

1264 var path6 = __require("node:path");

High

Child Process

Package source references child process execution.

dist/bin/cli.mjsView on unpkg · L1262

1265 var fs6 = __require("node:fs");

1266 var process2 = __require("node:process");

1267 var { Argument: Argument2, humanReadableArgName } = require_argument();

1268 var { CommanderError: CommanderError2 } = require_error();

1269 var { Help: Help2, stripColor } = require_help();

1270 var { Option: Option2, DualOptions } = require_option();

1271 var { suggestSimilar } = require_suggestSimilar();

1272 var Command2 = class _Command extends EventEmitter {

1273 /**

1274 * Initialize a new `Command`.

1275 *

1276 * @param {string} [name]

1277 */

1278 constructor(name) {

1279 super();

1280 this.commands = [];

1281 this.options = [];

1282 this.parent = null;

Lines 2095-2135javascript

2095 if (cmd.getOptionValueSource(key) !== void 0) {

2096 source = cmd.getOptionValueSource(key);

2097 }

2098 });

2099 return source;

2100 }

2101 /**

2102 * Get user arguments from implied or explicit arguments.

2103 * Side-effects: set _scriptPath if args included script. Used for default program name, and subcommand searches.

Lines 3619-3659javascript

3619 return getComponentName(a).localeCompare(getComponentName(b));

3620 });

3621 const finalContent = [themeImport, "", ...sortedExports].filter(Boolean).join("\n") + "\n";

3622 const finalContentWithEmptyLine

dist/bin/generate-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{createRequire}from"module";const require=createRequire(import.meta.url);

3var __defProp = Object.defineProperty;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/generate-skills.mjsView on unpkg · L1

4var __getOwnPropNames = Object.getOwnPropertyNames;