registry / domma-js / 0.40.0

domma-js@0.40.0

⚠ Under review

Dynamic Object Manipulation & Modeling API - A complete front-end toolkit.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 1.37 MB of source, external domains: cdn.jsdelivr.net, example.com, github.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 18-58json

18 "public/dist/domma.esm.js",

19 "public/dist/domma.css",

20 "public/dist/bundles/",

21 "public/dist/elements.css",

22 "public/dist/grid.css",

23 "public/dist/syntax.css",

24 "public/dist/domma-syntax.min.js",

25 "public/dist/domma-flags.min.js",

26 "public/dist/domma-flags.esm.js",

27 "public/dist/themes/",

28 "assets/types/",

29 "LICENSE",

30 "README.md"

31 ],

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/pinpointzero73/domma.git"

35 },

36 "type": "module",

37 "scripts": {

38 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 "start": "node bin/domma-cli.js serve",

40 "serve": "node bin/domma-cli.js serve",

41 "serve:3096": "node bin/domma-cli.js serve --port 3096",

42 "dev": "NODE_ENV=development npm run generate:bundles && rollup -c && node scripts/build-info.js && npm run build:metadata && npm run copy:themes && npm run generate:themes && npm run build:css && npm run build:miniapps && live-server public --port=3001 --open=/index.html",

43 "dev:watch": "NODE_ENV=development npm run generate:bundles && rollup -c && node scripts/build-info.js && npm run build:metadata && npm run copy:themes && npm run generate:themes && npm run build:css && npm run build:miniapps && npm run watch:miniapps",

44 "build": "npm run generate:bundles && rollup -c && node scripts/build-info.js && npm run build:metadata && npm run copy:themes && npm run generate:themes && npm run build:css && npm run build:css-bundles && npm run build:archives && npm run build:kickstart-files && npm run build:miniapps",

45 "build:js": "rollup -c",

46 "build:css": "node scripts/build-css.js",

47 "validate:classes": "node scripts/validate-classes.js",

48 "validate:theme": "node scripts/validate-theme-contrast.js",

49 "validate:conventions": "node scripts/validate-conventions.js",

50 "validate:showcase": "vitest run src/showcase-pages.test.js",

51 "validate:showcase:strict": "SHOWCASE_STRICT=1 vitest run src/showcase-pages.test.js",

52 "validate:showcase:baseline": "SHOWCASE_BASELINE=1 vitest run src/showcase-pages.test.js",

53 "validate": "npm run validate:classes && npm run validate:theme && npm run validate:conventions",

54 "build:css-bundles": "node scripts/build-css-bundles.js",

55 "build:archives": "node scripts/build-archives.js",

56 "build:kickstart-files": "node scripts/build-kickstart-files.js",

57 "build:info": "node scripts/build-info.js",

58 "build:metadata": "node scripts/copy-metadata.js",

public/dist/domma.esm.jsView file

9patternName = generic_password severity = medium line = 9 matchedText = /*! domm...lt};

Medium

Secret Pattern

Package contains a possible secret pattern.

public/dist/domma.esm.jsView on unpkg · L9

bin/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Domma Postinstall Script

5 * Offers to copy AI assistance files to the project root

6 */

8import { existsSync, mkdirSync, copyFileSync, readdirSync, statSync, readFileSync, writeFileSync } from 'fs';

9import { join, dirname, resolve } from

bin/domma-cli.jsView file

•matchType = normalized_sha256 matchedPackage = domma-js@0.33.1 matchedPath = bin/domma-cli.js matchedIdentity = npm:ZG9tbWEtanM:0.33.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/domma-cli.jsView on unpkg

public/dist/domma.min.jsView file

9patternName = generic_password severity = medium line = 9 matchedText = /*! domm...)});

Medium

Secret Pattern

Hardcoded password in public/dist/domma.min.js

public/dist/domma.min.jsView on unpkg · L9

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

public/dist/domma.esm.jsView file

9patternName = generic_password severity = medium line = 9 matchedText = /*! domm...lt};

Medium

Secret Pattern

Package contains a possible secret pattern.

public/dist/domma.esm.jsView on unpkg · L9

Findings

1 Critical2 High6 Medium4 Low

CriticalAi Agent Control Hijackbin/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritybin/domma-cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patternpublic/dist/domma.esm.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternpublic/dist/domma.min.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to domma-js@0.40.0.

See all versions of domma-js for other recorded verdicts.

Review the evidence and your use of domma-js@0.40.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-21 16:31:25.147Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.