registry / fontdue-js / 3.0.5

fontdue-js@3.0.5

React components for [Fontdue](https://fontdue.com) sites. Framework-agnostic: works in Next.js, Astro, React Router 7, TanStack Start, Vike, Remix, and any other React SSR or client-only environment.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 380 file(s), 2.78 MB of source, external domains: cdn.fontdue.com, stripe.com, www.unicode.org, www.w3.org

Source & flagged code

2 flagged

dist/components/Cart/AddressFields.jsView file

Lines 1-28javascript

1import _AddressFields_viewer from "../../__generated__/AddressFields_viewer.graphql.js";

2import React, { Fragment, useCallback, useEffect, useState } from 'react';

3import { fetchQuery, graphql, useRefetchableFragment, useRelayEnvironment } from 'react-relay';

4import TextField from '../TextField/index.js';

5import AddressFieldsRefetchQuery from '../../__generated__/AddressFieldsRefetchQuery.graphql.js';

6import { notEmpty } from '../../utils.js';

7import { AddressElement } from '@stripe/react-stripe-js';

8const MAPS_API_KEY = 'AIzaSyB9rSjGVPZYcRkPl1PDezIuAp3XCUs2Crk';

High

High Secret

Package contains a high-severity secret pattern.

dist/components/Cart/AddressFields.jsView on unpkg · L8

High

Secret Pattern

Google API key in dist/components/Cart/AddressFields.js

dist/components/Cart/AddressFields.jsView on unpkg · L8

9const AddressFields = _ref => {

10 var _viewer$countryData, _value$street, _viewer$settings;

11 let {

12 viewer: viewerKey,

13 value,

14 onChange,

15 identityType,

16 errorsObject,

17 allowedCountries

18 } = _ref;

19 const [refetching, setRefetching] = useState(false);

20 const [viewer, refetch] = useRefetchableFragment((_AddressFields_viewer.hash && _AddressFields_viewer.hash !== "2369fc95f554723701a8294b4522137a" && console.error("The definition of 'AddressFields_viewer' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _AddressFields_viewer), viewerKey);

21 const countryData = (_viewer$countryData = viewer.countryData) === null || _viewer$countryData === void 0 ? void 0 : _viewer$countryData.response;

22 const environment = useRelayEnvironment();

23 useEffect(() => {

24 setRefetching(true);

26 // refetch after using fetchQuery to avoid triggering Suspense

27 const subscription = fetchQuery(environment, AddressFieldsRefetchQuery, {

28 countryCode: value.country,

Source & flagged code

2 flagged · loading source

dist/components/Cart/AddressFields.jsView file

8patternName = google_api_key severity = high line = 8 matchedText = const MA...rk';

High

High Secret

Package contains a high-severity secret pattern.

dist/components/Cart/AddressFields.jsView on unpkg · L8

8patternName = google_api_key severity = high line = 8 matchedText = const MA...rk';

High

Secret Pattern

Google API key in dist/components/Cart/AddressFields.js

dist/components/Cart/AddressFields.jsView on unpkg · L8

Findings

2 High3 Medium5 Low

HighHigh Secretdist/components/Cart/AddressFields.js

HighSecret Patterndist/components/Cart/AddressFields.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/components/Cart/AddressFields.jsView file

Lines 1-28javascript

1import _AddressFields_viewer from "../../__generated__/AddressFields_viewer.graphql.js";

2import React, { Fragment, useCallback, useEffect, useState } from 'react';

3import { fetchQuery, graphql, useRefetchableFragment, useRelayEnvironment } from 'react-relay';

4import TextField from '../TextField/index.js';

5import AddressFieldsRefetchQuery from '../../__generated__/AddressFieldsRefetchQuery.graphql.js';

6import { notEmpty } from '../../utils.js';

7import { AddressElement } from '@stripe/react-stripe-js';

8const MAPS_API_KEY = 'AIzaSyB9rSjGVPZYcRkPl1PDezIuAp3XCUs2Crk';

High

High Secret

Package contains a high-severity secret pattern.

dist/components/Cart/AddressFields.jsView on unpkg · L8

High

Secret Pattern

Google API key in dist/components/Cart/AddressFields.js

dist/components/Cart/AddressFields.jsView on unpkg · L8

9const AddressFields = _ref => {

10 var _viewer$countryData, _value$street, _viewer$settings;

11 let {

12 viewer: viewerKey,

13 value,

14 onChange,

15 identityType,

16 errorsObject,

17 allowedCountries

18 } = _ref;

19 const [refetching, setRefetching] = useState(false);

21 const countryData = (_viewer$countryData = viewer.countryData) === null || _viewer$countryData === void 0 ? void 0 : _viewer$countryData.response;

22 const environment = useRelayEnvironment();

23 useEffect(() => {

24 setRefetching(true);

26 // refetch after using fetchQuery to avoid triggering Suspense

27 const subscription = fetchQuery(environment, AddressFieldsRefetchQuery, {

28 countryCode: value.country,