registry / bmdl-sdk / 2.0.42

bmdl-sdk@2.0.42

This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app).

Static Scan Results

scanned 19h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 189 file(s), 10.2 MB of source, external domains: bugs.webkit.org, developer.mozilla.org, evilmartians.com, getbootstrap.com, github.com, nextjs.org, react.dev, reactjs.org, stackoverflow.com, www.w3.org, www.w3ctech.com

Source & flagged code

4 flagged

dist/dev/server/chunks/ssr/node_modules_next_dist_compiled_0d323sd._.jsView file

Lines 2192-2232javascript

2192 module.exports = a;

2193})();

2194}),

2195"[project]/node_modules/next/dist/compiled/react-server-dom-turbopack/cjs/react-server-dom-turbopack-client.node.development.js [app-rsc] (ecmascript)", ((__turbopack_context__, module, exports) => {

2196"use strict";

2197

2198/**

2199 * @license React

2200 * react-server-dom-turbopack-client.node.development.js

2201 *

2202 * Copyright (c) Meta Platforms, Inc. and affiliates.

2203 *

2204 * This source code is licensed under the MIT license found in the

2205 * LICENSE file in the root directory of this source tree.

2206 */ "production" !== ("TURBOPACK compile-time value", "development") && function() {

2207 function checkEvalAvailabilityOnceDev() {

2208 if (!hasConfirmedEval) {

2209 hasConfirmedEval = !0;

2210 try {

2211 (0, eval)("null");

2212 } catch ($jscomp$unused$catch) {

2213 console.error("eval() is not supported in this environment. This can happen if you started the Node.js process with --disallow-code-generation-from-strings, or if `eval` was patched by other means. React requires eval() in development mode for various debugging features like reconstructing callstacks from a different environment.\nReact will never use eval() in production mode");

2214 }

High

Eval

Package source references dynamic code evaluation.

dist/dev/server/chunks/ssr/node_modules_next_dist_compiled_0d323sd._.jsView on unpkg · L2212

2215 }

2216 }

2217 function resolveClientReference(bundlerConfig, metadata) {

2218 if (bundlerConfig) {

2219 var moduleExports = bundlerConfig[metadata[0]];

2220 if (bundlerConfig = moduleExports && moduleExports[metadata[2]]) moduleExports = bundlerConfig.name;

2221 else {

2222 bundlerConfig = moduleExports && moduleExports["*"];

2223 if (!bundlerConfig) throw Error('Could not find the module "' + metadata[0] + '" in the React Server Consumer Manifest. This is probably a bug in the React Server Components bundler.');

2224 moduleExports = metadata[2];

2225 }

2226 return 4 === metadata.length ? [

2227 bundlerConfig.id,

2228 bundlerConfig.chunks,

2229 moduleExports,

2230 1

2231 ] : [

2232 bundlerConfig.id,

bin/dev.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2const { spawn } = require('child_process')

3const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/dev.jsView on unpkg · L1

dist/standalone/dist/static/media/bbc41e54d2fcbd21-s.1rgnod-3esatf.woff2View file

•path = [redacted]-s.1rgnod-3esatf.woff2 kind = high_entropy_blob sizeBytes = 14712 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/standalone/dist/static/media/bbc41e54d2fcbd21-s.1rgnod-3esatf.woff2View on unpkg

dist/dev/build/chunks/[root-of-the-server]__1f933tp._.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = bmdl-sdk@2.0.41 matchedIdentity = npm:Ym1kbC1zZGs:2.0.41 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dev/build/chunks/[root-of-the-server]__1f933tp._.jsView on unpkg

Source & flagged code

4 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code