registry / anentrypoint-design / 0.0.231

anentrypoint-design@0.0.231

⚠ Under review

247420 design system SDK — webjsx + modified ripple-ui, single-file ESM bundle for reproducible use of the AnEntrypoint design.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 144 file(s), 1.18 MB of source, external domains: 247420.xyz, cdn.jsdelivr.net, cdnjs.cloudflare.com, github.com, schema.org, unpkg.com, www.w3.org

Source & flagged code

3 flagged

dist/src/highlight.jsView file

Lines 1-33javascript

1// Syntax highlighting — lazy-loads Prism on first call. No-op safe.

3let _prism = null;

4let _ready = null;

6const PRISM_CORE = 'https://cdn.jsdelivr.net/npm/prismjs@1.30.0/components/prism-core.min.js';

8export async function ensurePrism() {

9 if (_prism) return _prism;

10 if (_ready) return _ready;

11 _ready = (async () => {

12 try {

13 // Prism is UMD; fetch & exec on the global.

14 const res = await fetch(PRISM_CORE);

15 const code = await res.text();

16 // eslint-disable-next-line no-new-func

17 new Function('window', code)(window);

18 _prism = window.Prism || null;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/highlight.jsView on unpkg · L5

High

Eval

Package source references dynamic code evaluation.

dist/src/highlight.jsView on unpkg · L16

19 return _prism;

20 } catch (err) {

21 console.warn('[247420] prism loader failed:', err);

22 return null;

23 }

24 })();

25 return _ready;

26}

28export async function highlightAllUnder(root) {

29 const Prism = await ensurePrism();

30 if (!Prism || !root) return;

31 if (typeof Prism.highlightAllUnder === 'function') Prism.highlightAllUnder(root);

32}

dist/247420.jsView file

Lines 102-142javascript

102 ::slotted(*) {

103 position: relative !important;

104 inset: auto !important;

105 width: var(--deck-design-w) !important;

106 height: var(--deck-design-h) !important;

107 box-sizing: border

Source & flagged code

3 flagged · loading source

dist/src/highlight.jsView file

5L6: const PRISM_CORE = 'https://cdn.jsdelivr.net/npm/prismjs@1.30.0/components/prism-core.min.js'; L7: ... L14: const res = await fetch(PRISM_CORE); L15: const code = await res.text(); L16: // eslint-disable-next-line no-new-func L17: new Function('window', code)(window); L18: _prism = window.Prism || null;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/highlight.jsView on unpkg · L5

16// eslint-disable-next-line no-new-func L17: new Function('window', code)(window); L18: _prism = window.Prism || null;

High

Eval

Package source references dynamic code evaluation.

dist/src/highlight.jsView on unpkg · L16

dist/247420.jsView file

122<button class="btn reset" type="button" aria-label="Reset to first slide" title="Reset (R)">Reset<span class="kbd">R</span></button> L123: `,s.querySelector(".prev").addEventListener("click",e),s.querySelector(".next").addEventListener("click",t),s.querySelector(".reset").addEventListener("click",n),s}function dr({onB... L124: ( o.o )

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/247420.jsView on unpkg · L122

Findings

1 Critical2 High3 Medium5 Low

CriticalRemote Asset Decode Executedist/src/highlight.js

HighChild Process

HighEvaldist/src/highlight.js

MediumDynamic Requiredist/247420.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/src/highlight.jsView file

Lines 1-33javascript

1// Syntax highlighting — lazy-loads Prism on first call. No-op safe.

3let _prism = null;

4let _ready = null;

6const PRISM_CORE = 'https://cdn.jsdelivr.net/npm/prismjs@1.30.0/components/prism-core.min.js';

8export async function ensurePrism() {

9 if (_prism) return _prism;

10 if (_ready) return _ready;

11 _ready = (async () => {

12 try {

13 // Prism is UMD; fetch & exec on the global.

14 const res = await fetch(PRISM_CORE);

15 const code = await res.text();

16 // eslint-disable-next-line no-new-func

17 new Function('window', code)(window);

18 _prism = window.Prism || null;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/highlight.jsView on unpkg · L5

High

Eval

Package source references dynamic code evaluation.

dist/src/highlight.jsView on unpkg · L16

19 return _prism;

20 } catch (err) {

21 console.warn('[247420] prism loader failed:', err);

22 return null;

23 }

24 })();

25 return _ready;

26}

28export async function highlightAllUnder(root) {

29 const Prism = await ensurePrism();

30 if (!Prism || !root) return;

31 if (typeof Prism.highlightAllUnder === 'function') Prism.highlightAllUnder(root);

32}

dist/247420.jsView file

Lines 102-142javascript

102 ::slotted(*) {

103 position: relative !important;

104 inset: auto !important;

105 width: var(--deck-design-w) !important;

106 height: var(--deck-design-h) !important;

107 box-sizing: border