registry  /  datastake-daf  /  0.7.212

datastake-daf@0.7.212

⚠ Under review

```bash git clone https://link-to-project ```

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedTelemetryUrlStrings
Manifest
NoLicense
scanned 1,785 file(s), 12.3 MB of source, external domains: 192.168.4.211, 192.168.4.43, 192.168.4.64, api.datastake.io, api.example.com, api.mapbox.com, corsproxy.io, d6emlwyqv3muw.cloudfront.net, example.com, flagcdn.com, flagsapi.com, images.unsplash.com, invalid-url-to-show-fallback.jpg, ipapi.co, lavoixdelituri.com, picsum.photos, static0.srcdn.com, whc.unesco.org, www.cahraslist.net, www.eeas.europa.eu, www.example.com, www.google.com, www.iturikwetu.net, www.iucn.org, www.nrc.no, www.w3.org, wwww.example.com, zeroextinction.org
Oversized source lightweight scan
dist/components/index.js4.62 MB file, sampled 256 KB
NetworkHighEntropyStrings
dist/pages/index.js5.53 MB file, sampled 256 KB
NetworkHighEntropyStrings

Source & flagged code

7 flagged · loading source
.envView file
1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 2 L1: REACT_APP_MAP_TOKEN=<redacted:90 token-like> L2: REACT_APP_MAP_TOKEN_DEFAULT=<redacted:86 token-like>
Critical
Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1
src/@daf/core/components/EditForm/RenderForm.jsView file
260try { L261: const fn = eval(form.editComponent); L262: return fn(
Low
Eval

Package source references a known benign dynamic code generation pattern.

src/@daf/core/components/EditForm/RenderForm.jsView on unpkg · L260
deploy.shView file
•path = deploy.sh kind = build_helper sizeBytes = 922 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

deploy.shView on unpkg
dist/style/datastake/fonts/sf-ui-display-bold-58646a511e3d9.woffView file
•path = dist/style/datastake/fonts/sf-ui-display-bold-58646a511e3d9.woff kind = high_entropy_blob sizeBytes = 117044 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/style/datastake/fonts/sf-ui-display-bold-58646a511e3d9.woffView on unpkg
dist/components/index.jsView file
•path = dist/components/index.js kind = oversized_source_file sizeBytes = 4846683 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/components/index.jsView on unpkg
dist/hooks/index.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = datastake-daf@0.7.210 matchedIdentity = npm:ZGF0YXN0YWtlLWRhZg:0.7.210 similarity = 0.642 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/hooks/index.jsView on unpkg
src/@daf/core/components/Screens/InformationChannels/InformationChanel.stories.tsxView file
475patternName = generic_password severity = medium line = 475 matchedText = password...NC",
Medium
Secret Pattern

Hardcoded password in src/@daf/core/components/Screens/InformationChannels/InformationChanel.stories.tsx

src/@daf/core/components/Screens/InformationChannels/InformationChanel.stories.tsxView on unpkg · L475

Findings

2 Critical2 High5 Medium8 Low
CriticalCritical Secret.env
CriticalPrevious Version Dangerous Deltadist/hooks/index.js
HighShips High Entropy Blobdist/style/datastake/fonts/sf-ui-display-bold-58646a511e3d9.woff
HighOversized Source Filedist/components/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
MediumSecret Patternsrc/@daf/core/components/Screens/InformationChannels/InformationChanel.stories.tsx
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalsrc/@daf/core/components/EditForm/RenderForm.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License