registry / chaite / 1.10.4

chaite@1.10.4

⚠ Under review

core for chatgpt-plugin and karin-plugin-chatgpt

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 112 file(s), 6.86 MB of source, external domains: 169.254.169.254, accounts.google.com, aiplatform.googleapis.com, alova.js.org, api.anthropic.com, api.github.com, api.iconify.design, api.openai.com, api.simplesvg.com, api.unisvg.com, cloud.google.com, cloudresourcemanager.googleapis.com, developer.mozilla.org, docs.anthropic.com, docs.expo.dev, dom.spec.whatwg.org, dub.sh, fetch.spec.whatwg.org, generativelanguage.googleapis.com, git.io, github.com, github.githubassets.com, goo.gl, help.openai.com, html.spec.whatwg.org, jimmy.warting.se, metadata.google.internal, oauth2.googleapis.com, purl.oclc.org, schemas.microsoft.com, schemas.openxmlformats.org, schemas.zwobble.org, stackoverflow.com, stuk.github.io, vuejs.org, w3c.github.io, www.chaite.cloud, www.google.com, www.googleapis.com, www.gstatic.com, www.naiveui.com, www.saxproject.org, www.w3.org

Source & flagged code

8 flagged

frontend/build/assets/index-Dugb8uS8.jsView file

Lines 1-30javascript

1import{d as Su,j as cn,K as Jo,s as Qu,aJ as wu,ba as ku,bb as vu,O as yi,G as $u}from"./index-DiiuGLuO.js";let dr=[],Fa=[];(()=>{let n="lc,34,7n,7,7b,19,,,,2,,2,,,20,b,1c,l,g,,2t,7,2,6,2,2,,4,z,,u,r,2j,b,1m,9,9,,o,4,,9,,3,,5,17,3,3b,f,,w,1j,,,,4,8,4,,3,7,a,2,t,,1m,,,,2,4,8,,9,,a,2,q,,2,2,1l,,4,2,4,2,2,3,3,,u,2,3,,b,2,1l,,4,5,,2,4,,k,2,m,6,,,1m,,,2,,4,8,,7,3,a,2,u,,1n,,,,c,,9,,14,,3,,1l,3,5,3,,4,7,2,b,2,t,,1m,,2,,2,,3,,5,2,7,2,b,2,s,2,1l,2,,,2,4,8,,9,,a,2,t,,20,,4,,2,3,,,8,,29,,2,7,c,8,2q,,2,9,b,6,22,2,r,,,,,,1j,e,,5,,2,5,b,,10,9,,2u,4,,6,,2,2,2,p,2,4,3,g,4,d,,2,2,6,,f,,jj,3,qa,3,t,3,t,2,u,2,1 ...

2`){[e,t]=ri(this,e,t);let s="";for(let r=0,o=0;r<=t&&o<this.text.length;o++){let l=this.text[o],a=r+l.length;r>e&&o&&(s+=i),e<a&&t>r&&(s+=l.slice(Math.max(0,e-r),t-r)),r=a+1}return s}flatten(e){for(let t of this.text)e.push(t)}scanIdentical(){return 0}static split(e,t){let i=[],s=-1;for(let r of e)i.push(r),s+=r.length+1,i.length==32&&(t.push(new J(i,s)),i=[],s=-1);return s>-1&&t.push(new J(i,s)),t}}class He extends _{constructor(e,t){super(),this.children=e,this.length=t,this.lines=0;for(let i of e)this.lines+=i.lines}lineInner(e,t,i,s){for(let r=0;;r++){let o=this.children[r],l=s+o.length,a= ...

3`){[e,t]=ri(this,e,t);let s="";for(let r=0,o=0;r<this.children.length&&o<=t;r++){let l=this.children[r],a=o+l.length;o>e&&r&&(s+=i),e<

4`,this;e--}else if(s instanceof J){let a=s.text[o+(t<0?-1:0)];if(this.offsets[i]+=t,a.length>Math.max(0,e))return this.value=e==0?a:t>0?a.slice(e):a.slice(0,a.length-e),this;e-=a.length}else{let a=s.children[o+(t<0?-1:0)];e>a.length?(e-=a.length,this.offsets[i]+=t):(t<0&&this.offsets[i]--,this.nodes.push(a),this.offsets.push(t>0?1:(a instanceof J?a.text.length:a.children.length)<<1))}}}next(e=0){return e<0&&(this.nextInner(-e,-this.dir),e=this.value.length),this.nextInner(e,this.dir)}}class eh{constructor(e,t,i){this.value="",this.done=!1,this.cursor=new Ci(e,t>i?-1:1),this.pos=t>i?e.length:0, ...

5`}get readOnly(){return this.facet(ch)}phrase(e,...t){for(let i of this.facet(W.phrases))if(Object.prototype.hasOwnProperty.call(i,e)){e=i[e];break}return t.length&&(e=e.replace(/\$(\$|\d*)/g,(i,s)=>{if(s=="$")

6`)}static newName(){let e=hl[al]||1;return hl[al]=e+1,$r+e.toString(36)}static mount(e,t,i){let s=e[Pr],r=i&&i.nonce;s?r&&s.setNonce(r):s=new ju(e,r),s.mount(Array.isArray(t)?t:[t],e)}}let cl=new Map;class ju{constructor(e,t){let i=e.ownerDocument||e,s=i.defaultView;if(!e.head&&e.adoptedStyleSheets&&s.CSSStyleSheet){let r=cl.get(i);if(r)return e[Pr]=r;this.sheet=new s.CSSStyleSheet,cl.set(i,this)}else this.styleTag=i.createElement("style"),t&&this.styleTag.setAttribute("nonce",t);this.modules=[],e[Pr]=this}mount(e,t){let i=this.sheet,s=0,r=0;for(let o=0;o<e.length;o++){let l=e[o],a=this.module ...

7`;this.styleTag.textContent=o;let l=t.head||t;this.styleTag.parentNode!=l&&l.insertBefore(this.styleTag,l.firstChild)}}setNonce(e){this.styleTag&&this.styleTag.getAttribute("nonce")!=e&&this.styleTag.setAttribute("nonce",e)}}var Qt={8:"Backspace",9:"Tab",10:"Enter",12:"NumLock",13:"Enter",16:"Shift",17:"Control",18:"Alt",20:"CapsLock",27:"Escape"

8`,s=n.state.doc.line(s.number+(t?1:-1)),r=n.bidiSpans(s),h=n.visualLineSide(s,!t)}if(a){if(!a(c))return l}else{if(!i)return h;a=i(c)}l=h}}function Ed(n,e,t){let i=

9 `&&n.lineWrapping&&(i&&(i=x.single(i.main.anchor-1,i.main.head-1)),t={from:r.from,to:r.to,insert:_.of([" "])}),t)return wo(n,t,i,o);if(i&&!Fn(i,r)){let l=!1,a="select";return n.inputState.lastSelectionTime>Date.now()-50&&(n.inputState.lastSelectionOrigin=="select"&&(l=!0),a=n.inputState.lastSelectionOrigin,a=="select.pointer"&&(i=Ih(s.facet(tn).map(h=>h(n)),i))),n.dispatch({selection:i,scrollIntoView:l,userEvent:a}),!0}else return!1}function wo(n,e,t,i=-1){if(P.ios&&n.inputState.flushIOSKey(e))return!0;let s=n.state.selection.main;if(P.android&&(e.to==s.to&&(e.from==s.from||e.from==s.from-1&& ...

11--؜‎‏\u2028\u2029‭‮⁦⁧⁩\uFEFF￹-]`,Ir),NO={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"carriage return",27:"escape",8203:"zero width space",8204:"zero width non-joiner",8205:"zero width joiner",8206:"left-to-right mark",8207:"right-to-left mark",8232:"line separator",8237:"left-to-right override",8238:"right-to-left override",8294:"left-to-right isolate",8295:"right-to-left isolate",8297:"pop directional isolate",8233:"paragraph separator",65279:"zero width no-break space",65532:"object replacement"};let Is=null;function GO(){var n;if(Is==null&&typeof document<"u"&&d ...

12`:i=="r"?"\r":i=="t"?" ":"\\")}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&&this.test==e.test}create(){return this.regexp?new

13 * vue-codemirror6

14 *

15 * @description CodeMirror6 Component for vue2 and vue3.

16 * @author Logue <logue@hotmail.co.jp>

17 * @license MIT

18 * @version 1.6.1

19 * @see {@link https://github.com/logue/vue-codemirror6}

20 */const V1=n=>n?Object.entries(n).reduce((e,[t,i])=>(t=t.charAt(0).toUpperCase()+t.slice(1),t=`on${t}`,{...e,[t]:i}),{}):{};function Ea(n,

21`)===C)return;const M=!s.value.state.selection.ranges.every(ue=>ue.anchor<C.length&&ue.head<C.length),B={from:0,to:s.value.state.doc.length,insert:C},G=n.preserveScrollPosition?s.value.scrollSnapshot().map(s.value.state.changes(B)):void 0;s.value.dispatch({changes:B,selection:M?{anchor:0,head:0}:s.value.state.selection,scrollIntoView:n.scrollIntoView,effects:G?[G]:void 0})},{immediate:!0}),Qu(async()=>{if(globalThis.window===void 0||!t.value)return;let C=i.value;t.value.childNodes[0]&&(i.value!==""&&console.warn("[CodeMirror.vue] The <code-mirror> tag contains child elements that overwrite the ...

22 \${}

23} catch (\${error}) {

24 \${}

25}`,{label:"try",detail:"/ catch block",type:"keyword"}),xe("if (${}) {\n ${}\n}",{label:"if",detail:"block",type:"keyword"}),xe(`if (\${}) {

26 \${}

27} else {

28 \${}

29}`,{label:"if",detail:"/ else block",type:"keyword"}),xe(`class \${name} {

30 constructor(\${params}) {

Long lines were clipped for display.

dist/chunks/lop/index.mjs-BWbOMJZv.mjsView file

Lines 1056-1096javascript

1056 var index = 0;

1057 var source = "__p+='";

1058 text.replace(matcher$1, function(match, escape, interpolate, evaluate, offset) {

1059 source += text.slice

dist/index.mjsView file

Lines 1-21javascript

1import { s as __toESM } from "./rolldown-runtime-DVriDoez.mjs";

2import { t as __dirname } from "./__dirname-BYuaqN8u.mjs";

3import "./chunks/lop/index.mjs-BWbOMJZv.mjs";

4import "./chunks/bluebird/index.mjs-D4zFjek8.mjs";

5import { t as require_lib } from "./chunks/mammoth/index.mjs-DOMhYI-I.mjs"

dist/chunks/cookie-signature/index.mjs-BMcPfKwp.mjsView file

Lines 1-34javascript

1import { i as __require, t as __commonJS } from "../../rolldown-runtime-DVriDoez.mjs";

3//#region node_modules/.pnpm/cookie-signature@1.0.6/node_modules/cookie-signature/index.js

4var require_cookie_signature = /* @__PURE__ */ __commonJS({ "node_modules/.pnpm/cookie-signature@1.0.6/node_modules/cookie-signature/index.js": ((exports) => {

5 /**

dist/chunks/@google/genai/index.mjs-BrdPnzXZ.mjsView file

8L9: //#region node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js L10: var require_base64_js = /* @__PURE__ */ __commonJS({ "node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js": ((exports) => { ... L99: var require_safe_buffer = /* @__PURE__ */ __commonJS({ "node_modules/.pnpm/safe-buffer@5.2.1/node_modules/safe-buffer/index.js": ((exports, module) => { L100: /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */ L101: var buffer = __require("buffer"); ... L350: //#endregion L351: //#region node_modules/.pnpm/gaxios@7.1.3/node_modules/gaxios/package.json L352: var require_package$1 = /* @__PURE__ */ __commonJS({ "node_modules/.pnpm/gaxios@7.1.3/node_modules/gaxios/package.json": ((exports, module) => { ... L639: if (!obj || typeof obj !== "object") return; L640: else if (obj instanceof FormData || obj instanceof URLSearchParams || "forEach" in obj && "set" in obj) obj.forEach((_, key) => { L641: if (["grant_type", "assertion"].includes(key) || /secret/.test(key)) obj.set(key, REDACT);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/@google/genai/index.mjs-BrdPnzXZ.mjsView on unpkg · L8

Source & flagged code

8 flagged · loading source

frontend/build/assets/index-Dugb8uS8.jsView file

10`))};if((P.mac||P.android)&&f.from==o-1&&/^\. ?$/.test(i.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(f={from:l,to:a,insert:_.of([i.text.replace("."," ")])}),this.pendi... L11: --؜‎‏\u2028\u2029‭‮⁦⁧⁩\uFEFF￹-]`,Ir),NO={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"carriage return",27:"escape",8203:"zero width space",8204:"zero wi... L12: `:i=="r"?"\r":i=="t"?" ":"\\")}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&...

High

Child Process

Package source references child process execution.

frontend/build/assets/index-Dugb8uS8.jsView on unpkg · L10

dist/chunks/lop/index.mjs-BWbOMJZv.mjsView file

1076try { L1077: render = new Function(argument, "_", source); L1078: } catch (e) {

High

Eval

Package source references dynamic code evaluation.

dist/chunks/lop/index.mjs-BWbOMJZv.mjsView on unpkg · L1076

dist/index.mjsView file

1import { s as __toESM } from "./rolldown-runtime-DVriDoez.mjs"; L2: import { t as __dirname } from "./__dirname-BYuaqN8u.mjs"; L3: import "./chunks/lop/index.mjs-BWbOMJZv.mjs"; ... L13: import "./chunks/dingbat-to-unicode/index.mjs-DjR5pQCM.mjs"; L14: import { t as axios_default } from "./chunks/axios/index.mjs-BJujW20l.mjs"; L15: import "./chunks/accepts/index.mjs-CtXuJELB.mjs"; ... L39: import * as crypto from "node:crypto"; L40: import { spawn } from "node:child_process"; L41: ... L69: fromString(str) { L70: return JSON.parse(str); L71: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.mjs L1: import { s as __toESM } from "./rolldown-runtime-DVriDoez.mjs"; L2: import { t as __dirname } from "./__dirname-BYuaqN8u.mjs"; L3: import "./chunks/lop/index.mjs-BWbOMJZv.mjs"; ... L13: import "./chunks/dingbat-to-unicode/index.mjs-DjR5pQCM.mjs"; L14: import { t as axios_default } from "./chunks/axios/index.mjs-BJujW20l.mjs"; L15: import "./chunks/accepts/index.mjs-CtXuJELB.mjs"; ... L39: import * as crypto from "node:crypto"; L40: import { spawn } from "node:child_process"; L41: ... L69: fromString(str) { L70: return JSON.parse(str); L71: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

1Cross-file remote execution chain: dist/index.mjs spawns dist/chunks/@anthropic-ai/sdk/index.mjs-sKjldQtK.mjs; helper contains network access plus dynamic code execution. L1: import { s as __toESM } from "./rolldown-runtime-DVriDoez.mjs"; L2: import { t as __dirname } from "./__dirname-BYuaqN8u.mjs"; L3: import "./chunks/lop/index.mjs-BWbOMJZv.mjs"; ... L13: import "./chunks/dingbat-to-unicode/index.mjs-DjR5pQCM.mjs"; L14: import { t as axios_default } from "./chunks/axios/index.mjs-BJujW20l.mjs"; L15: import "./chunks/accepts/index.mjs-CtXuJELB.mjs"; ... L39: import * as crypto from "node:crypto"; L40: import { spawn } from "node:child_process"; L41: ... L69: fromString(str) { L70: return JSON.parse(str); L71: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L1

661try { L662: const module = await import(`${`file://${path$1.resolve(filePath)}`}?update=${Date.now()}`); L663: if (!("default" in module)) return null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L661

dist/chunks/cookie-signature/index.mjs-BMcPfKwp.mjsView file

14* @return {String} L15: * @api private L16: */ ... L19: if ("string" != typeof secret) throw new TypeError("Secret string must be provided."); L20: return val + "." + crypto.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, ""); L21: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/cookie-signature/index.mjs-BMcPfKwp.mjsView on unpkg · L14

dist/chunks/@google/genai/index.mjs-BrdPnzXZ.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/@google/genai/index.mjs-BrdPnzXZ.mjsView on unpkg · L8

Findings

2 Critical5 High4 Medium7 Low

CriticalCredential Exfiltrationdist/index.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

HighChild Processfrontend/build/assets/index-Dugb8uS8.js

HighShell

HighEvaldist/chunks/lop/index.mjs-BWbOMJZv.mjs

HighCloud Metadata Accessdist/chunks/@google/genai/index.mjs-BrdPnzXZ.mjs

HighCross File Remote Execution Contextdist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/chunks/cookie-signature/index.mjs-BMcPfKwp.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

8 flagged

frontend/build/assets/index-Dugb8uS8.jsView file

Lines 1-30javascript

3`){[e,t]=ri(this,e,t);let s="";for(let r=0,o=0;r<this.children.length&&o<=t;r++){let l=this.children[r],a=o+l.length;o>e&&r&&(s+=i),e<

8`,s=n.state.doc.line(s.number+(t?1:-1)),r=n.bidiSpans(s),h=n.visualLineSide(s,!t)}if(a){if(!a(c))return l}else{if(!i)return h;a=i(c)}l=h}}function Ed(n,e,t){let i=

13 * vue-codemirror6

14 *

15 * @description CodeMirror6 Component for vue2 and vue3.

16 * @author Logue <logue@hotmail.co.jp>

17 * @license MIT

18 * @version 1.6.1

19 * @see {@link https://github.com/logue/vue-codemirror6}

20 */const V1=n=>n?Object.entries(n).reduce((e,[t,i])=>(t=t.charAt(0).toUpperCase()+t.slice(1),t=`on${t}`,{...e,[t]:i}),{}):{};function Ea(n,

22 \${}

23} catch (\${error}) {

24 \${}

25}`,{label:"try",detail:"/ catch block",type:"keyword"}),xe("if (${}) {\n ${}\n}",{label:"if",detail:"block",type:"keyword"}),xe(`if (\${}) {

26 \${}

27} else {

28 \${}

29}`,{label:"if",detail:"/ else block",type:"keyword"}),xe(`class \${name} {

30 constructor(\${params}) {

Long lines were clipped for display.

dist/chunks/lop/index.mjs-BWbOMJZv.mjsView file

Lines 1056-1096javascript

1056 var index = 0;

1057 var source = "__p+='";

1058 text.replace(matcher$1, function(match, escape, interpolate, evaluate, offset) {

1059 source += text.slice

dist/index.mjsView file

Lines 1-21javascript

1import { s as __toESM } from "./rolldown-runtime-DVriDoez.mjs";

2import { t as __dirname } from "./__dirname-BYuaqN8u.mjs";

3import "./chunks/lop/index.mjs-BWbOMJZv.mjs";

4import "./chunks/bluebird/index.mjs-D4zFjek8.mjs";

5import { t as require_lib } from "./chunks/mammoth/index.mjs-DOMhYI-I.mjs"

dist/chunks/cookie-signature/index.mjs-BMcPfKwp.mjsView file

Lines 1-34javascript

1import { i as __require, t as __commonJS } from "../../rolldown-runtime-DVriDoez.mjs";

3//#region node_modules/.pnpm/cookie-signature@1.0.6/node_modules/cookie-signature/index.js

4var require_cookie_signature = /* @__PURE__ */ __commonJS({ "node_modules/.pnpm/cookie-signature@1.0.6/node_modules/cookie-signature/index.js": ((exports) => {

5 /**

dist/chunks/@google/genai/index.mjs-BrdPnzXZ.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/@google/genai/index.mjs-BrdPnzXZ.mjsView on unpkg · L8