registry / getfloorplan-gltf-widget / 1.17.3

getfloorplan-gltf-widget@1.17.3

Widget for GLTF estate plans.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 14 file(s), 2.86 MB of source, external domains: developer.mozilla.org, developers.facebook.com, docs.sentry.io, example.com, gist.github.com, github.com, issuetracker.google.com, npms.io, null.example, react.dev, reactjs.org, webostv.developer.lge.com, www.example.com, www.w3.org

Oversized source lightweight scan

build/createWidget.js2.26 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsUrlStringswww.w3.org

Source & flagged code

3 flagged

build/plugins/SentryPlugin.jsView file

Lines 3551-3591javascript

3551}

3552function Zu(t, e) {

3553 const n = t.indexOf("://") <= 0 && t.indexOf("//") !== 0, r = n ? Jh : void 0;

3554 try {

3555 if ("canParse" in URL && !URL.canParse(t, r))

3556 return;

3557 const s = new URL(t, r);

3558 return n ? {

3559 isRelative: n,

3560 pathname: s.pathname,

3561 search: s.search,

3562 hash: s.hash

3563 } : s;

3564 } catch {

3565 }

3566}

3567function Qh(t) {

3568 if (Qu(t))

3569 return t.pathname;

3570 const e = new URL(t);

3571 return e.search = "", e.hash = "", ["80", "443"].includes(e.port) && (e.port = ""), e.password && (e.password = "%filtered%"), e.username && (e.username = "%filtered%"

3572}

3573function We(t) {

3574 if (!t)

3575 return {};

3576 const e = t.match(/^(([^:/?#]+):)?(\/\/([^/?#]*))?([^?#]*)(\?(

3577 if (!e)

3578 return {};

3579 const n = e[6] || "", r = e[8] || "";

3580 return {

3581 host: e[4],

3582 path: e[5],

3583 protocol: e[2],

3584 search: n,

3585 hash: r,

3586 relative: e[5] + n + r

3587 // everything minus origin

3588 };

3589}

3590function Zh(t) {

3591 return t.split(/[?#]/, 1)[0];

build/plugins/DebugPanelPlugin.jsView file

Lines 8389-8429javascript

8389 return !t.isReporting && !!t.report;

8390 },

8391 get children() {

8392 var f = _tmpl$2();

8393

build/AIXSolutionsVendor.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/AIXSolutionsVendor.cssView on unpkg

Source & flagged code

3 flagged · loading source

build/plugins/SentryPlugin.jsView file

3571patternName = generic_password severity = medium line = 3571

Medium

Secret Pattern

Package contains a possible secret pattern.

build/plugins/SentryPlugin.jsView on unpkg · L3571

build/plugins/DebugPanelPlugin.jsView file

8409async function loadDraco3DAsync() { L8410: const wasmBinary = await fetch(dracoDecoderWasmUrl).then((n) => n.arrayBuffer()), i = dracoWasmWrapperJs.indexOf('"object"===typeof exports'), createDraco3D = eval(dracoWasmWrapper... L8411: return createDraco3D({ wasmBinary });

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/plugins/DebugPanelPlugin.jsView on unpkg · L8409

build/AIXSolutionsVendor.cssView file

Findings

1 High4 Medium6 Low

HighSemantic Analysis Limitedbuild/AIXSolutionsVendor.css

MediumSecret Patternbuild/plugins/SentryPlugin.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvalbuild/plugins/DebugPanelPlugin.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to getfloorplan-gltf-widget@1.17.3.

See all versions of getfloorplan-gltf-widget for other recorded verdicts.

Review the evidence and your use of getfloorplan-gltf-widget@1.17.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 13:11:03.253Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.