registry / feedsweep / 2.19.0

feedsweep@2.19.0

⚠ Under review

Tidy up the HTML content in web feeds. Fix feed-specific quirks so content displays in its best possible form.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 81 file(s), 144 KB of source, external domains: fast.wistia.net, i.ytimg.com, player.vimeo.com, vimeo.com, www.dailymotion.com, www.youtube.com

Source & flagged code

2 flagged

dist/transforms/dom/normalizeAnchoredHeadings.jsView file

Lines 1-39javascript

1import { hasAncestorWithTagName } from "../../utils/dom.js";

2import { isSamePage } from "../../utils/urls.js";

3//#region src/transforms/dom/normalizeAnchoredHeadings.ts

4const headingSelector = "h1, h2, h3, h4, h5, h6";

5const supTags = /* @__PURE__ */ new Set(["sup"]);

6const permalinkClasses = /* @__PURE__ */ new Set([

7 "headerlink",

8 "header-anchor",

9 "heading-anchor",

10 "heading-link",

11 "heading-mark",

12 "hash-link",

13 "anchorjs-link",

14 "zola-anchor",

15 "o-heading-link",

16 "wiki-anchor",

17 "permalink"

18]);

19const permalinkLabelRegex = /^[#¶§❡\u{1f517}]+$/u;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/transforms/dom/normalizeAnchoredHeadings.jsView on unpkg · L19

20const footnoteClassRegex = /footnote/i;

21const bracketedNumberRegex = /^\[\d+\]$/;

22const whitespaceRegex = /\s+/;

24const interactiveAttrRegex = /toggle|accordion|collapse/i;

25const isGlyphMarker = (text, fragment) => {

26 const trimmed = text.trim();

27 return trimmed === "" || permalinkLabelRegex.test(trimmed) || trimmed === `#${fragment}`;

28};

29const slugify = (value) => {

30 return value.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");

31};

32const normalizeAnchoredHeadings = ({ baseUrl, resolveUrlFn }) => {

33 return (document) => {

34 const headings = document.querySelectorAll(headingSelector);

35 for (const heading of headings) {

36 const headingId = heading.getAttribute("id");

37 const headingSlug = slugify(heading.textContent ?? "");

38 const anchors = heading.querySelectorAll("a");

39 let permalinkFragment = null;

•Trigger-reachable chain: manifest.exports -> dist/index.js -> [redacted].js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/transforms/dom/normalizeAnchoredHeadings.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/transforms/dom/normalizeAnchoredHeadings.jsView file

19contains invisible/control Unicode U+200B (zero width space) const permalinkLabelRegex = /^[#¶§❡\u{1f517}<U+200B>]+$/u;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/transforms/dom/normalizeAnchoredHeadings.jsView on unpkg · L19

•Trigger-reachable chain: manifest.exports -> dist/index.js -> [redacted].js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/transforms/dom/normalizeAnchoredHeadings.jsView on unpkg

Findings

2 Critical1 Medium3 Low

CriticalTrojan Source Unicodedist/transforms/dom/normalizeAnchoredHeadings.js

CriticalTrigger Reachable Dangerous Capabilitydist/transforms/dom/normalizeAnchoredHeadings.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

Source & flagged code

2 flagged

dist/transforms/dom/normalizeAnchoredHeadings.jsView file

Lines 1-39javascript

1import { hasAncestorWithTagName } from "../../utils/dom.js";

2import { isSamePage } from "../../utils/urls.js";

3//#region src/transforms/dom/normalizeAnchoredHeadings.ts

4const headingSelector = "h1, h2, h3, h4, h5, h6";

5const supTags = /* @__PURE__ */ new Set(["sup"]);

6const permalinkClasses = /* @__PURE__ */ new Set([

7 "headerlink",

8 "header-anchor",

9 "heading-anchor",

10 "heading-link",

11 "heading-mark",

12 "hash-link",

13 "anchorjs-link",

14 "zola-anchor",

15 "o-heading-link",

16 "wiki-anchor",

17 "permalink"

18]);

19const permalinkLabelRegex = /^[#¶§❡\u{1f517}]+$/u;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/transforms/dom/normalizeAnchoredHeadings.jsView on unpkg · L19

20const footnoteClassRegex = /footnote/i;

21const bracketedNumberRegex = /^\[\d+\]$/;

22const whitespaceRegex = /\s+/;

24const interactiveAttrRegex = /toggle|accordion|collapse/i;

25const isGlyphMarker = (text, fragment) => {

26 const trimmed = text.trim();

27 return trimmed === "" || permalinkLabelRegex.test(trimmed) || trimmed === `#${fragment}`;

28};

29const slugify = (value) => {

30 return value.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");

31};

32const normalizeAnchoredHeadings = ({ baseUrl, resolveUrlFn }) => {

33 return (document) => {

34 const headings = document.querySelectorAll(headingSelector);

35 for (const heading of headings) {

36 const headingId = heading.getAttribute("id");

37 const headingSlug = slugify(heading.textContent ?? "");

38 const anchors = heading.querySelectorAll("a");

39 let permalinkFragment = null;

•Trigger-reachable chain: manifest.exports -> dist/index.js -> [redacted].js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/transforms/dom/normalizeAnchoredHeadings.jsView on unpkg