annotask: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

5 flagged

dist/vendor/html2canvas.min.jsView file

Lines 1-11javascript

1/*!

2 * html2canvas-pro 2.0.2 <https://yorickshan.github.io/html2canvas-pro/>

4 * Released under MIT License

5 */

6((A,e)=>{"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?define(["exports"],e):e((A="undefined"!=typeof globalThis?globalThis:A||self).html2canvas={})})(this,function(l){class F{constructor(A,e,t,r){this.left=A,this.top=e,this.width=t,this.height=r}add(A,e,t,r){return new F(this.left+A,this.top+e,this.width+t,this.height+r)}static fromClientRect(A,e){return new F(e.left+A.windowBounds.left,e.top+A.windowBounds.top,e.width,e.height)}static fromDOMRectList(A,e){e=Array.from(e);let t=e.find(A=>0!==A.width);return(t=!(t=t||e.find(A=>0!==A.heigh ...

7 content: "" !important;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vendor/html2canvas.min.jsView on unpkg · L5

8 display: none !important;

9}`,$n=(A,e)=>{Ai(A,`.${zn}:before${jn}

10 .${qn}:after`+jn,e)},Ai=(A,e,t)=>{var r=A.ownerDocument;r&&((r=r.createElement("style")).textContent=e,t&&(r.nonce=t),A.appendChild(r))},ei=(A,e)=>{var t=A.ownerDocument.createElement("base"),e=(t.href=e,A.getElementsByTagName("head").item(0));e?.insertBefore(t,e?.firstChild??null)};class D{constructor(A,e){this.type=0,this.x=A,this.y=e}add(A,e){return new D(this.x+A,this.y+e)}}let ti=(A,e,t)=>new D(A.x+(e.x-A.x)*t,A.y+(e.y-A.y)*t);class ri{constructor(A,e,t,r){this.type=1,this.start=A,this.startControl=e,this.endControl=t,this.end=r}subdivide(A,e){var t=ti(this.start,this.startContro ...

11📊 Performance Summary (Total: ${A.totalDuration.toFixed(2)}ms):`),A.breakdown.sort((A,e)=>e.duration-A.duration).forEach(A=>{this.context.logger.info(` ${A

Long lines were clipped for display.

dist/proxy-serve-BVWKTMU7.jsView file

3660try { L3661: return await import("@vue/compiler-sfc"); L3662: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/proxy-serve-BVWKTMU7.jsView on unpkg · L3660

17// src/server/proxy-serve.ts L18: import http from "http"; L19: import https from "https"; ... L151: var UploadScreenshotBody = z.object({ L152: data: z.string().regex(/^data:image\/png;base64,/, "Invalid PNG data URL") L153: }); ... L3417: if (negate) pkgs.delete(dir); L3418: else if (fs2.existsSync(path4.join(dir, "package.json"))) pkgs.add(dir); L3419: } ... L4920: if (isIpLiteral(hostname)) return true; L4921: const envList = (process.env.ANNOTASK_ALLOWED_HOSTS ?? "").split(",").map((s) => s.trim()).filter(Boolean); L4922: for (const entry of [...extraAllowed, ...envList]) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/proxy-serve-BVWKTMU7.jsView on unpkg · L17

dist/typescript-HEENVABD.jsView file

•path = dist/typescript-HEENVABD.js kind = oversized_source_file sizeBytes = 10021551 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/typescript-HEENVABD.jsView on unpkg

•path = dist/typescript-HEENVABD.js kind = oversized_cli_entrypoint sizeBytes = 10021551 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/typescript-HEENVABD.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/vendor/html2canvas.min.jsView file

5*/ L6: ((A,e)=>{"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?define(["exports"],e):e((A="undefined"!=typeof globalThis?globalThis:... L7: content: "" !important;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vendor/html2canvas.min.jsView on unpkg · L5

dist/proxy-serve-BVWKTMU7.jsView file

3660try { L3661: return await import("@vue/compiler-sfc"); L3662: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/proxy-serve-BVWKTMU7.jsView on unpkg · L3660

annotask: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

dist/vendor/html2canvas.min.jsView file

Lines 1-11javascript

1/*!

2 * html2canvas-pro 2.0.2 <https://yorickshan.github.io/html2canvas-pro/>

4 * Released under MIT License

5 */

7 content: "" !important;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vendor/html2canvas.min.jsView on unpkg · L5

8 display: none !important;

9}`,$n=(A,e)=>{Ai(A,`.${zn}:before${jn}

11📊 Performance Summary (Total: ${A.totalDuration.toFixed(2)}ms):`),A.breakdown.sort((A,e)=>e.duration-A.duration).forEach(A=>{this.context.logger.info(` ${A

Long lines were clipped for display.

dist/proxy-serve-BVWKTMU7.jsView file

3660try { L3661: return await import("@vue/compiler-sfc"); L3662: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/proxy-serve-BVWKTMU7.jsView on unpkg · L3660

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/proxy-serve-BVWKTMU7.jsView on unpkg · L17

dist/typescript-HEENVABD.jsView file

•path = dist/typescript-HEENVABD.js kind = oversized_source_file sizeBytes = 10021551 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/typescript-HEENVABD.jsView on unpkg

•path = dist/typescript-HEENVABD.js kind = oversized_cli_entrypoint sizeBytes = 10021551 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/typescript-HEENVABD.jsView on unpkg

annotask@0.4.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code