registry / af-mobile-client-vue3 / 1.6.59

af-mobile-client-vue3@1.6.59

Vue + Vite component lib

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 147 file(s), 406 KB of source, external domains: 127.0.0.1, 192.168.50.67, 219.153.176.6, k8s.aofengcloud.com, www.baidu.com

Source & flagged code

4 flagged

.env.productionView file

•patternName = blocked_file severity = critical matchedText = .env.production redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.productionView on unpkg

src/utils/runEvalFunction.tsView file

Lines 1-14typescript

1export function executeStrFunction(funcString, args) {

2 // 使用 eval 执行传入的函数字符串

3 // eslint-disable-next-line no-eval

4 return eval(`(${funcString})`)(...args)

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/utils/runEvalFunction.tsView on unpkg · L3

7export function executeStrFunctionByContext(context, fnStr, args) {

8 // 使用 new Function 创建函数，并绑定 context 作为 this

9 // eslint-disable-next-line no-new-func

10 const fn = new Function(`return (${fnStr});`)()

11 // 使用 bind 绑定 context，并立即调用

12 return fn.bind(context)(...args)

13}

src/font-style/Inter-Medium.woff2View file

•path = src/font-style/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 114348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/font-style/Inter-Medium.woff2View on unpkg

certs/127.0.0.1+2-key.pemView file

Lines 1-21text

1-----BEGIN PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in certs/127.0.0.1+2-key.pem

certs/127.0.0.1+2-key.pemView on unpkg · L1

2MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQChKsPmzaqY3iw4

3nugwJIdl/Xf4HA33hxiNs1u5VnL/DceCz/6uOfj/pi1w3N4Zzn8j58aY5Oh2HTDJ

4laaDEHQmq7suBgeAVIJoplr4SDQEyecehqH5bHt4MnJ5ize1ldNxzXgO5a2XwfPz

5YxWw90jZk1QEQIgS1Ip90amJk7al+M/+dIb61uoET/xLIrcVXtc9lzglPyZpNYQd

6LB0hkjd+Ed8c5Hx90/gc/JJh3Ur1YfWREr4SJwfz1+KbUGbADEFwaLX6G5Hma6qi

7gC3OZ13M1+bxpxT01+TGtPzUhFADFF+ychj8v4U4UbypgsiW9Wya7LHRNUfODmXc

8UT2M5O/pAgMBAAECggEAUtmDH3D2k+MSZID751O/7uQf+gGiBG8EZkOfkWUpdIgG

92e5GhBX1NKaekXhZDHck0LZjV1HFVoKnA9nUYWfh7cc2T/B1hrjq2RU7iorDgvqv

Source & flagged code

4 flagged · loading source

.env.productionView file

•patternName = blocked_file severity = critical matchedText = .env.production redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.productionView on unpkg

src/utils/runEvalFunction.tsView file

3// eslint-disable-next-line no-eval L4: return eval(`(${funcString})`)(...args) L5: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/utils/runEvalFunction.tsView on unpkg · L3

src/font-style/Inter-Medium.woff2View file

•path = src/font-style/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 114348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/font-style/Inter-Medium.woff2View on unpkg

certs/127.0.0.1+2-key.pemView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in certs/127.0.0.1+2-key.pem

certs/127.0.0.1+2-key.pemView on unpkg · L1

Findings

2 Critical1 High3 Medium7 Low

CriticalCritical Secret.env.production

CriticalSecret Patterncerts/127.0.0.1+2-key.pem

HighShips High Entropy Blobsrc/font-style/Inter-Medium.woff2

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/utils/runEvalFunction.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License