registry / aca-design / 1.2.37

aca-design@1.2.37

Package containing most used components and css themes for all off Acadomia projects.

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 4 file(s), 2.31 MB of source, external domains: cdnjs.cloudflare.com, contact.acadomia.fr, github.com, ip2c.org, maps.googleapis.com, pastebin.com, tc39.github.io, www.w3.org

Source & flagged code

11 flagged

dist/aca-design.umd.min.jsView file

Lines 1-2javascript

1(function(t,e){"object"===typeof exports&&"object"===typeof module?module.exports=e():"function"===typeof define&&define.amd?define([],e):"object"===typeof exports?exports["aca-design"]=e():t["aca-design"]=e()})("undefined"!==typeof self?self:this,(function(){return function(t){var e={};function n(r){if(e[r])return e[r].exports;var a=e[r]={i:r,l:!1,exports:{}};return t[r].call(a.exports,a,a.exports,n),a.l=!0,a.exports}return n.m=t,n.c=e,n.d=function(t,e,r){n.o(t,e)||Object.defineProperty(t,e,{enumerable:!0,get:r})},n.r=function(t){"undefined"!==typeof Symbol&&Symbol.toStringTag&&Object.defineP ...

High

High Secret

Package contains a high-severity secret pattern.

dist/aca-design.umd.min.jsView on unpkg · L1

High

Secret Pattern

Google API key in dist/aca-design.umd.min.js

dist/aca-design.umd.min.jsView on unpkg · L1

2//# sourceMappingURL=aca-design.umd.min.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/aca-design.umd.min.jsView on unpkg · L1

Long lines were clipped for display.

dist/font-icon/aca-icons.woffView file

•path = dist/font-icon/aca-icons.woff kind = high_entropy_blob sizeBytes = 5328 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/font-icon/aca-icons.woffView on unpkg

.yarn/releases/yarn-1.22.15.cjsView file

•path = .yarn/releases/yarn-1.22.15.cjs kind = payload_in_excluded_dir sizeBytes = 5102234 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.yarn/releases/yarn-1.22.15.cjsView on unpkg

•path = .yarn/releases/yarn-1.22.15.cjs kind = oversized_source_file sizeBytes = 5102234 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.yarn/releases/yarn-1.22.15.cjsView on unpkg

•path = .yarn/releases/yarn-1.22.15.cjs kind = oversized_cli_entrypoint sizeBytes = 5102234 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

.yarn/releases/yarn-1.22.15.cjsView on unpkg

package.jsonView file

Lines 1-24json

2 "name": "aca-design",

3 "version": "1.2.37",

4 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L4

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L4

dist/aca-design.common.jsView file

9063patternName = google_api_key severity = high line = 9063 matchedText = key: 'AI...NQ',

High

Secret Pattern

Google API key in dist/aca-design.common.js

dist/aca-design.common.jsView on unpkg · L9063

dist/aca-design.umd.jsView file

9072patternName = google_api_key severity = high line = 9072 matchedText = key: 'AI...NQ',

High

Secret Pattern

Google API key in dist/aca-design.umd.js

dist/aca-design.umd.jsView on unpkg · L9072

Source & flagged code

11 flagged · loading source

dist/aca-design.umd.min.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code