registry / brep-io-kernel / 1.0.289

brep-io-kernel@1.0.289

- [NPM package: `brep-io-kernel` https://www.npmjs.com/package/brep-io-kernel](https://www.npmjs.com/package/brep-io-kernel) - [Live API examples https://BREP.io/apiExamples/index.html](https://BREP.io/apiExamples/index.html) - [Developer Discord https:

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 575 file(s), 23.5 MB of source, external domains: api.github.com, autodrop3d.com, babel.dev, blog.izs.me, brep.io, bugs.debian.org, cdn.jsdelivr.net, core-js.io, creativecommons.org, dejavu-fonts.github.io, design.ubuntu.com, developer.mozilla.org, dxf.vercel.app, example.com, github.com, html2canvas.hertzen.com, jcgt.org, marked.js.org, n8.io, openfontlicense.org, rapier.rs, raw.githubusercontent.com, schemas.microsoft.com, schemas.openxmlformats.org, scripts.sil.org, stuartk.com, tc39.es, threejs.org, www.boutrosfonts.com, www.debian.org, www.gnu.org, www.jmsole.cl, www.tipo.net.ar, www.w3.org

Oversized source lightweight scan

dist/assets/CAD-CbYOPW3n-Bb0nT0lB.js6.28 MB file, sampled 256 KB

FilesystemDynamicRequireHighEntropyStringsMinifiedUrlStringsbrep.io

dist/assets/FeatureRegistry-C0Y1otAX.js5.31 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringswww.w3.org

dist/assets/PartHistory-DcIy3BGg-C80Kmows.js8.23 MB file, sampled 256 KB

HighEntropyStringsMinified

dist/assets/featureDialogs-CyDGzPbz.js3.28 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringswww.w3.org

dist/assets/main-cad-qDLwsRRm.js5.93 MB file, sampled 256 KB

NetworkHighEntropyStringsUrlStringsapi.github.comwww.w3.org

dist/assets/rapier-BP7Ta1oP-N5pb81sD.js2.18 MB file, sampled 256 KB

EvalHighEntropyStringsMinified

dist-kernel/CAD-CbYOPW3n.js7.96 MB file, sampled 256 KB

FilesystemDynamicRequireHighEntropyStrings

dist-kernel/PartHistory-DcIy3BGg.js9.05 MB file, sampled 256 KB

HighEntropyStrings

dist-kernel/rapier-BP7Ta1oP.js2.39 MB file, sampled 256 KB

HighEntropyStrings

Source & flagged code

8 flagged

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var DQ=O...()+`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var DQ=O...()+`

Critical

Secret Pattern

AWS access key ID in dist/assets/manifold-Dae-4w_d-DYgt_kqs.js

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView on unpkg · L1

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView file

Lines 1-19javascript

1var oC=Object.defineProperty;var Q=(G,a)=>oC(G,"name",{value:a,configurable:!0});var DC=Object.defineProperty,C=Q((G,a)=>DC(G,"name",{value:a,configurable:!0}),"C"),rC=(()=>{var G=typeof document<"u"&&document.currentScript?document.currentScript.src:void 0;return typeof __filename<"u"&&(G=G||__filename),(function(o){o=o||{};var o=typeof o<"u"?o:{},l,R;o.ready=new Promise(function(A,I){l=A,R=I});const $="__dirname";var Z=Object.assign({},o),AA=typeof window=="object",x=typeof importScripts=="function",b=typeof process=="object"&&typeof process.versions=="object"&&typeof process.versions.node== ...

2 "use strict"; return body.apply(this, arguments);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView on unpkg · L1

3};

4`)(I)}Q(eA,"hA"),C(eA,"createNamedFunction");function kA(A,I){var g=eA(I,function(B){this.name=I,this.message=B;var E=new Error(B).stack;E!==void 0&&(this.stack=this.toString()+`

5`+E.replace(/^Error(:[^\n]*)?\n/,""))});return g.prototype=Object.create(A.prototype),g.prototype.constructor=g,g.prototype.toString=function(){return this.message===void 0?this.name:this.name+": "+this.message},g}Q(kA,"uA"),C(kA,"extendError");var BA=void 0;function h(A){throw new BA(A)}Q(h,"n"),C(h,"throwBindingError");var pI=void 0;function aA(A){throw new pI(A)}Q(aA,"yA"),C(aA,"throwInternalError");function T(A,I,g){A.forEach(function(i){RA[i]=I});function B(i){var t=g(i);t.length!==A.length&&aA("Mismatched type converter count");for(var s=0;s<A.length;++s)u(A[s],t[s])}Q(B,"B"),C(B,"onComp ...

6if (arguments.length !== `+(D-2)+`) {

7throwBindingError('function `+A+" called with ' + arguments.length + ' arguments, expected "+(D-2)+` args!');

9`;i&&(n+=`var destructors = [];

10`);var y=i?"destructors":"null",F=["throwBindingError","invoker","fn","runDestructors","retType","classParam"],S=[h,B,E,jA,I[0],I[1]];r&&(n+="var thisWired = classParam.toWireType("+

11`);for(var t=0;t<D-2;++t)n+="var arg"+t+"Wired = argType"+t+".toWireType("+y+", arg"+t+"); // "+I[t+2].name+`

12`,F.push("argType"+t),S.push(I[t+2]);if(r&&(w="thisWired"+(w.length>0?", ":"")+w),n+=(s?"var rv = ":"")+"invoker(fn"+(w.

13`,i)n+=`runDestructors(destructors);

14`;else for(var t=r?1:2;t<I.length;++t){var Y=t===1?"thisWired":"arg"+(t-2)+"Wired";I[t].destructorFunction!==null&&(

15`,F.push(Y+"_dtor"),S.push(I[t].destructorFunction))}s&&(n+=`var ret = retType.fromWireType(rv);

16return ret;

17`),n+=`}

18`,F.push(n);var d=ag(Function,F).apply(null,S);return d}Q(VA,"DI"),C(VA,"craftInvokerFunction");function wg(A,I,g,B,

Long lines were clipped for display.

dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasmView file

•path = dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasm kind = wasm_module sizeBytes = 1570176 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasmView on unpkg

dist/assets/rapier-BP7Ta1oP-N5pb81sD.jsView file

•path = dist/assets/rapier-BP7Ta1oP-N5pb81sD.js kind = oversized_source_file sizeBytes = 2288928 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/rapier-BP7Ta1oP-N5pb81sD.jsView on unpkg

dist-kernel/browserTests-DKQqg5aq.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = brep-io-kernel@1.0.286 matchedIdentity = npm:YnJlcC1pby1rZXJuZWw:1.0.286 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-kernel/browserTests-DKQqg5aq.jsView on unpkg

dist-kernel/manifold-Dae-4w_d.jsView file

501patternName = aws_access_key severity = critical line = 501 matchedText = return n...ref;

Critical

Secret Pattern

AWS access key ID in dist-kernel/manifold-Dae-4w_d.js

dist-kernel/manifold-Dae-4w_d.jsView on unpkg · L501

Source & flagged code

8 flagged · loading source

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var DQ=O...()+`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var DQ=O...()+`

Critical

Secret Pattern

AWS access key ID in dist/assets/manifold-Dae-4w_d-DYgt_kqs.js

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView on unpkg · L1

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView on unpkg · L1

dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasmView file

•path = dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasm kind = wasm_module sizeBytes = 1570176 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasmView on unpkg

dist/assets/rapier-BP7Ta1oP-N5pb81sD.jsView file

•path = dist/assets/rapier-BP7Ta1oP-N5pb81sD.js kind = oversized_source_file sizeBytes = 2288928 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/rapier-BP7Ta1oP-N5pb81sD.jsView on unpkg

dist-kernel/browserTests-DKQqg5aq.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-kernel/browserTests-DKQqg5aq.jsView on unpkg

dist-kernel/manifold-Dae-4w_d.jsView file

501patternName = aws_access_key severity = critical line = 501 matchedText = return n...ref;

Critical

Secret Pattern

AWS access key ID in dist-kernel/manifold-Dae-4w_d.js

dist-kernel/manifold-Dae-4w_d.jsView on unpkg · L501

Findings

3 Critical2 High4 Medium8 Low

CriticalCritical Secretdist/assets/manifold-Dae-4w_d-DYgt_kqs.js

CriticalSecret Patterndist/assets/manifold-Dae-4w_d-DYgt_kqs.js

CriticalSecret Patterndist-kernel/manifold-Dae-4w_d.js

HighOversized Source Filedist/assets/rapier-BP7Ta1oP-N5pb81sD.js

HighPrevious Version Dangerous Deltadist-kernel/browserTests-DKQqg5aq.js

MediumDynamic Requiredist/assets/vhacd-C8k5e0Pv-DnlmoJET.js

MediumNetwork

MediumShips Wasm Moduledist/assets/rapier_wasm3d_bg-bb0TTxsO.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/assets/vhacd-C8k5e0Pv-DnlmoJET.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var DQ=O...()+`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var DQ=O...()+`

Critical

Secret Pattern

AWS access key ID in dist/assets/manifold-Dae-4w_d-DYgt_kqs.js

dist/assets/manifold-Dae-4w_d-DYgt_kqs.jsView on unpkg · L1

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView file

Lines 1-19javascript

2 "use strict"; return body.apply(this, arguments);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vhacd-C8k5e0Pv-DnlmoJET.jsView on unpkg · L1

3};

4`)(I)}Q(eA,"hA"),C(eA,"createNamedFunction");function kA(A,I){var g=eA(I,function(B){this.name=I,this.message=B;var E=new Error(B).stack;E!==void 0&&(this.stack=this.toString()+`

6if (arguments.length !== `+(D-2)+`) {

7throwBindingError('function `+A+" called with ' + arguments.length + ' arguments, expected "+(D-2)+` args!');

9`;i&&(n+=`var destructors = [];

10`);var y=i?"destructors":"null",F=["throwBindingError","invoker","fn","runDestructors","retType","classParam"],S=[h,B,E,jA,I[0],I[1]];r&&(n+="var thisWired = classParam.toWireType("+

11`);for(var t=0;t<D-2;++t)n+="var arg"+t+"Wired = argType"+t+".toWireType("+y+", arg"+t+"); // "+I[t+2].name+`

12`,F.push("argType"+t),S.push(I[t+2]);if(r&&(w="thisWired"+(w.length>0?", ":"")+w),n+=(s?"var rv = ":"")+"invoker(fn"+(w.

13`,i)n+=`runDestructors(destructors);

14`;else for(var t=r?1:2;t<I.length;++t){var Y=t===1?"thisWired":"arg"+(t-2)+"Wired";I[t].destructorFunction!==null&&(

15`,F.push(Y+"_dtor"),S.push(I[t].destructorFunction))}s&&(n+=`var ret = retType.fromWireType(rv);

16return ret;

17`),n+=`}

18`,F.push(n);var d=ag(Function,F).apply(null,S);return d}Q(VA,"DI"),C(VA,"craftInvokerFunction");function wg(A,I,g,B,

Long lines were clipped for display.

dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasmView file

•path = dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasm kind = wasm_module sizeBytes = 1570176 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/rapier_wasm3d_bg-bb0TTxsO.wasmView on unpkg

dist/assets/rapier-BP7Ta1oP-N5pb81sD.jsView file

•path = dist/assets/rapier-BP7Ta1oP-N5pb81sD.js kind = oversized_source_file sizeBytes = 2288928 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/rapier-BP7Ta1oP-N5pb81sD.jsView on unpkg

dist-kernel/browserTests-DKQqg5aq.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-kernel/browserTests-DKQqg5aq.jsView on unpkg

dist-kernel/manifold-Dae-4w_d.jsView file

501patternName = aws_access_key severity = critical line = 501 matchedText = return n...ref;

Critical

Secret Pattern

AWS access key ID in dist-kernel/manifold-Dae-4w_d.js

dist-kernel/manifold-Dae-4w_d.jsView on unpkg · L501