registry / getfloorplan-gltf-widget / 1.17.4

getfloorplan-gltf-widget@1.17.4

Widget for GLTF estate plans.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 14 file(s), 2.86 MB of source, external domains: docs.sentry.io, example.com, github.com, npms.io, null.example, www.example.com, www.w3.org

Oversized source lightweight scan

build/createWidget.js2.26 MB file, sampled 256 KB

NetworkHighEntropyStringsUrlStringsgithub.comwww.w3.org

Source & flagged code

4 flagged

build/plugins/SentryPlugin.jsView file

Lines 3551-3591javascript

3551}

3552function Zu(t, e) {

3553 const n = t.indexOf("://") <= 0 && t.indexOf("//") !== 0, r = n ? Jh : void 0;

3554 try {

3555 if ("canParse" in URL && !URL.canParse(t, r))

3556 return;

3557 const s = new URL(t, r);

3558 return n ? {

3559 isRelative: n,

3560 pathname: s.pathname,

3561 search: s.search,

3562 hash: s.hash

3563 } : s;

3564 } catch {

3565 }

3566}

3567function Qh(t) {

3568 if (Qu(t))

3569 return t.pathname;

3570 const e = new URL(t);

3571 return e.search = "", e.hash = "", ["80", "443"].includes(e.port) && (e.port = ""), e.password && (e.password = "%filtered%"), e.username && (e.username = "%filtered%"

3572}

3573function We(t) {

3574 if (!t)

3575 return {};

3576 const e = t.match(/^(([^:/?#]+):)?(\/\/([^/?#]*))?([^?#]*)(\?(

3577 if (!e)

3578 return {};

3579 const n = e[6] || "", r = e[8] || "";

3580 return {

3581 host: e[4],

3582 path: e[5],

3583 protocol: e[2],

3584 search: n,

3585 hash: r,

3586 relative: e[5] + n + r

3587 // everything minus origin

3588 };

3589}

3590function Zh(t) {

3591 return t.split(/[?#]/, 1)[0];

build/plugins/DebugPanelPlugin.jsView file

Lines 8389-8429javascript

8389 return !t.isReporting && !!t.report;

8390 },

8391 get children() {

8392 var f = _tmpl$2();

8393

build/AIXSolutionsVendor.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/AIXSolutionsVendor.cssView on unpkg

build/index-yz0aRVnu.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = getfloorplan-gltf-widget@1.17.3 matchedIdentity = npm:[redacted]:1.17.3 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/index-yz0aRVnu.jsView on unpkg

Source & flagged code

4 flagged · loading source

build/plugins/SentryPlugin.jsView file

3571patternName = generic_password severity = medium line = 3571

Medium

Secret Pattern

Package contains a possible secret pattern.

build/plugins/SentryPlugin.jsView on unpkg · L3571

build/plugins/DebugPanelPlugin.jsView file

8409async function loadDraco3DAsync() { L8410: const wasmBinary = await fetch(dracoDecoderWasmUrl).then((n) => n.arrayBuffer()), i = dracoWasmWrapperJs.indexOf('"object"===typeof exports'), createDraco3D = eval(dracoWasmWrapper... L8411: return createDraco3D({ wasmBinary });

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/plugins/DebugPanelPlugin.jsView on unpkg · L8409

build/AIXSolutionsVendor.cssView file

Findings

2 High4 Medium5 Low

HighSemantic Analysis Limitedbuild/AIXSolutionsVendor.css

HighPrevious Version Dangerous Deltabuild/index-yz0aRVnu.js

MediumSecret Patternbuild/plugins/SentryPlugin.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvalbuild/plugins/DebugPanelPlugin.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to getfloorplan-gltf-widget@1.17.4.

See all versions of getfloorplan-gltf-widget for other recorded verdicts.

Review the evidence and your use of getfloorplan-gltf-widget@1.17.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 01:21:52.482Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.