registry / ezuikit-js / 9.0.12

ezuikit-js@9.0.12

ezuikit javascript for npm

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 3.72 MB of source, external domains: github.com, open.ys7.com, openstatic.ys7.com

Oversized source lightweight scan

ezuikit.js3.50 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsgithub.com

ezuikit_static/PlayCtrlWasm/playCtrl1/HasSIMD/Decoder.js2.33 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinified

index.js3.37 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsopen.ys7.comopenstatic.ys7.com

index.mjs3.36 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsopen.ys7.comopenstatic.ys7.com

Source & flagged code

4 flagged

ezuikit_static/talk/adapeter.jsView file

Lines 5029-5078javascript

5029 // Serializes DTLS parameters to SDP.

5030 SDPUtils.writeDtlsParameters = function(params, setupType) {

5031 var sdp = 'a=setup:' + setupType + '\r\n';

5032 params.fingerprints.forEach(function(fp) {

5033 sdp += 'a=fingerprint:' + fp.algorithm + ' ' + fp.value + '\r\n';

5034 });

5035 return sdp;

5036 };

5037 // Parses ICE information from SDP media section or sessionpart.

5038 // FIXME: for consistency with other functions this should only

5039 // get the ice-ufrag and ice-pwd lines as input.

5040 SDPUtils.getIceParameters = function(mediaSection, sessionpart) {

5041 var lines = SDPUtils.splitLines(mediaSection);

5042 // Search in session part, too.

5043 lines = lines.concat(SDPUtils.splitLines(sessionpart));

5044 var iceParameters = {

5045 usernameFragment: lines.filter(function(line) {

5046 return line.indexOf('a=ice-ufrag:') === 0;

5047 })[0].substr(12),

5048 password: lines.filter(function(line) {

5049 return line.indexOf('a=ice-pwd:') === 0;

Medium

Secret Pattern

Package contains a possible secret pattern.

ezuikit_static/talk/adapeter.jsView on unpkg · L5049

5050 })[0].substr(10)

5051 };

5052 return iceParameters;

5053 };

5054

5055 // Serializes ICE parameters to SDP.

5056 SDPUtils.writeIceParameters = function(params) {

5057 return 'a=ice-ufrag:' + params.usernameFragment + '\r\n' +

5058 'a=ice-pwd:' + params.password + '\r\n';

Medium

Secret Pattern

Hardcoded password in ezuikit_static/talk/adapeter.js

ezuikit_static/talk/adapeter.jsView on unpkg · L5058

5059 };

5060

5061 // Parses the SDP media section and returns RTCRtpParameters.

5062 SDPUtils.parseRtpParameters = function(mediaSection) {

5063 var description = {

5064 codecs: [],

5065 headerExtensions: [],

5066 fecMechanisms: [],

5067 rtcp: []

5068 };

5069 var lines = SDPUtils.splitLines(mediaSection);

5070 var mline = lines[0].split(' ');

5071 for (var i = 3; i < mline.length; i++) { // find all codecs from mline[3..]

5072 var pt = mline[i];

5073 var rtpmapline = SDPUtils.matchPrefix(

5074 mediaSection, 'a=rtpmap:' + pt + ' ')[0];

5075 if (rtpmapline) {

5076 var codec = SDPUtils.parseRtpMap(rtpmapline);

5077 var fmtps = SDPUtils.matchPrefix(

5078 mediaSection, 'a=fmtp:' + pt + ' ');

ezuikit_static/PlayCtrlWasm/playCtrl3/hasWorker/HasSIMD/Decoder.wasmView file

•path = ezuikit_static[redacted].wasm kind = wasm_module sizeBytes = 3625663 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

ezuikit_static/PlayCtrlWasm/playCtrl3/hasWorker/HasSIMD/Decoder.wasmView on unpkg

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 3529344 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

Source & flagged code

4 flagged · loading source

ezuikit_static/talk/adapeter.jsView file

5049patternName = generic_password severity = medium line = 5049 matchedText = return l...= 0;

Medium

Secret Pattern

Package contains a possible secret pattern.

ezuikit_static/talk/adapeter.jsView on unpkg · L5049

5058patternName = generic_password severity = medium line = 5058 matchedText = 'a=ice-p...\n';

Medium

Secret Pattern

Hardcoded password in ezuikit_static/talk/adapeter.js

ezuikit_static/talk/adapeter.jsView on unpkg · L5058

ezuikit_static/PlayCtrlWasm/playCtrl3/hasWorker/HasSIMD/Decoder.wasmView file

•path = ezuikit_static[redacted].wasm kind = wasm_module sizeBytes = 3625663 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

ezuikit_static/PlayCtrlWasm/playCtrl3/hasWorker/HasSIMD/Decoder.wasmView on unpkg

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 3529344 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

Findings

1 High5 Medium3 Low

HighOversized Source Fileindex.js

MediumSecret Patternezuikit_static/talk/adapeter.js

MediumNetwork

MediumShips Wasm Moduleezuikit_static/PlayCtrlWasm/playCtrl3/hasWorker/HasSIMD/Decoder.wasm

MediumStructural Risk Force Deep Review

MediumSecret Patternezuikit_static/talk/adapeter.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

ezuikit_static/talk/adapeter.jsView file

Lines 5029-5078javascript

5029 // Serializes DTLS parameters to SDP.

5030 SDPUtils.writeDtlsParameters = function(params, setupType) {

5031 var sdp = 'a=setup:' + setupType + '\r\n';

5032 params.fingerprints.forEach(function(fp) {

5033 sdp += 'a=fingerprint:' + fp.algorithm + ' ' + fp.value + '\r\n';

5034 });

5035 return sdp;

5036 };

5037 // Parses ICE information from SDP media section or sessionpart.

5038 // FIXME: for consistency with other functions this should only

5039 // get the ice-ufrag and ice-pwd lines as input.

5040 SDPUtils.getIceParameters = function(mediaSection, sessionpart) {

5041 var lines = SDPUtils.splitLines(mediaSection);

5042 // Search in session part, too.

5043 lines = lines.concat(SDPUtils.splitLines(sessionpart));

5044 var iceParameters = {

5045 usernameFragment: lines.filter(function(line) {

5046 return line.indexOf('a=ice-ufrag:') === 0;

5047 })[0].substr(12),

5048 password: lines.filter(function(line) {

5049 return line.indexOf('a=ice-pwd:') === 0;

Medium

Secret Pattern

Package contains a possible secret pattern.

ezuikit_static/talk/adapeter.jsView on unpkg · L5049

5050 })[0].substr(10)

5051 };

5052 return iceParameters;

5053 };

5054

5055 // Serializes ICE parameters to SDP.

5056 SDPUtils.writeIceParameters = function(params) {

5057 return 'a=ice-ufrag:' + params.usernameFragment + '\r\n' +

5058 'a=ice-pwd:' + params.password + '\r\n';

Medium

Secret Pattern

Hardcoded password in ezuikit_static/talk/adapeter.js

ezuikit_static/talk/adapeter.jsView on unpkg · L5058

5059 };

5060

5061 // Parses the SDP media section and returns RTCRtpParameters.

5062 SDPUtils.parseRtpParameters = function(mediaSection) {

5063 var description = {

5064 codecs: [],

5065 headerExtensions: [],

5066 fecMechanisms: [],

5067 rtcp: []

5068 };

5069 var lines = SDPUtils.splitLines(mediaSection);

5070 var mline = lines[0].split(' ');

5071 for (var i = 3; i < mline.length; i++) { // find all codecs from mline[3..]

5072 var pt = mline[i];

5073 var rtpmapline = SDPUtils.matchPrefix(

5074 mediaSection, 'a=rtpmap:' + pt + ' ')[0];

5075 if (rtpmapline) {

5076 var codec = SDPUtils.parseRtpMap(rtpmapline);

5077 var fmtps = SDPUtils.matchPrefix(

5078 mediaSection, 'a=fmtp:' + pt + ' ');

ezuikit_static/PlayCtrlWasm/playCtrl3/hasWorker/HasSIMD/Decoder.wasmView file

•path = ezuikit_static[redacted].wasm kind = wasm_module sizeBytes = 3625663 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

ezuikit_static/PlayCtrlWasm/playCtrl3/hasWorker/HasSIMD/Decoder.wasmView on unpkg

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 3529344 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg