registry  /  dealpos  /  26.25.4

dealpos@26.25.4

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Manifest
NoLicense
scanned 376 file(s), 13.9 MB of source, external domains: aka.ms, alg.li, angular.dev, app.midtrans.com, app.prntscr.com, blog.dealpos.com, books.dealpos.app, cdn.dealpos.app, cdn.dealpos.xyz, cdn.jsdelivr.net, cdn.tiny.cloud, changelog.dealpos.app, changelog.dealpos.com, display.dealpos.app, fonts.googleapis.com, github.com, learn.microsoft.com, midtrans.com, momentjs.com, ods.dealpos.app, play.google.com, popper.js.org, pub-5a8de9b3d4454b2faa2709eadbe7f51f.r2.dev, receipt.dealpos.app, remote.site.example, res.cloudinary.com, schemas.microsoft.com, status.dealpos.com, storage.dealpos.app, support.dealpos.com, uppy.io, wa.me, www.algolia.com, www.dealpos.app, www.dealpos.co.id, www.dealpos.com, www.highcharts.com, www.w3.org

Source & flagged code

5 flagged · loading source
browser/chunk-VW7FYM7T.jsView file
1patternName = google_api_key severity = high line = 1 matchedText = var e={p...and}
High
High Secret

Package contains a high-severity secret pattern.

browser/chunk-VW7FYM7T.jsView on unpkg · L1
1patternName = google_api_key severity = high line = 1 matchedText = var e={p...and}
High
Secret Pattern

Google API key in browser/chunk-VW7FYM7T.js

browser/chunk-VW7FYM7T.jsView on unpkg · L1
browser/chunk-RN23PFKE.jsView file
4`)&&r.flags==="s")})},8814:function(i,u,t){var e=t(9039),n=t(4576).RegExp;i.exports=e(function(){var r=n("(?<a>b)","g");return r.exec("b").groups.a!=="b"||"b".replace(r,"$<a>c")!==... L5: \v\f\r \xA0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200A\u202F\u205F\u3000\u2028\u2029\uFEFF`},8706:function(i,u,t){var e=t(6518),n=t(9039),r=t(4376),o=t... L6: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function Pt(i,u){if(i){if(typeof i=="string")return Kt(i,u);var t={}.toString.call(i).slice...
Low
Eval

Package source references a known benign dynamic code generation pattern.

browser/chunk-RN23PFKE.jsView on unpkg · L4
browser/chunk-UYUDEGLJ.jsView file
1import{b as Ye,c as Xe,d as Ze,e as et,f as tt}from"./chunk-DL3EFTTB.js";import{a as Je}from"./chunk-PM2FPEAY.js";import{a as Qe}from"./chunk-T7Z6HBXB.js";import{b as He,c as ze,e ...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

browser/chunk-UYUDEGLJ.jsView on unpkg · L1
browser/media/primeicons-4GST5W3O.woff2View file
•path = browser/media/primeicons-4GST5W3O.woff2 kind = high_entropy_blob sizeBytes = 35148 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

browser/media/primeicons-4GST5W3O.woff2View on unpkg

Findings

3 High5 Medium6 Low
HighHigh Secretbrowser/chunk-VW7FYM7T.js
HighShips High Entropy Blobbrowser/media/primeicons-4GST5W3O.woff2
HighSecret Patternbrowser/chunk-VW7FYM7T.js
MediumDynamic Requirebrowser/chunk-UYUDEGLJ.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowEvalbrowser/chunk-RN23PFKE.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License