registry  /  haocang-csk-gis-frame-work  /  1.0.25

haocang-csk-gis-frame-work@1.0.25

GIS地图框架工具集 — MapboxGL / MapGIS 地图初始化、图层管理、绘制编辑、巡检业务等功能模块

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessNetwork
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 192 file(s), 1.90 MB of source, external domains: 36.133.23.184, api.tianditu.gov.cn, geoserver.yw.hc-yun.com, t0.tianditu.gov.cn, www.opengis.net, www.w3.org

Source & flagged code

9 flagged · loading source
mapboxgl/utils/mapbox_native.jsView file
75patternName = supabase_service_key severity = critical line = 75 matchedText = Cesium_A...fc',
Critical
Critical Secret

Package contains a critical-looking secret pattern.

mapboxgl/utils/mapbox_native.jsView on unpkg · L75
75patternName = supabase_service_key severity = critical line = 75 matchedText = Cesium_A...fc',
Critical
Secret Pattern

Supabase service role key (JWT) in mapboxgl/utils/mapbox_native.js

mapboxgl/utils/mapbox_native.jsView on unpkg · L75
baseSetting/style/getDefaultFonts.pyView file
•path = [redacted].py kind = build_helper sizeBytes = 952 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

baseSetting/style/getDefaultFonts.pyView on unpkg
mapboxgl/style/fonts/Open Sans Regular,Arial Unicode MS Regular/12288-12543.pbfView file
•path = mapboxgl/style/fonts/Open Sans Regular,Arial Unicode MS Regular/12288-12543.pbf kind = high_entropy_blob sizeBytes = 134697 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

mapboxgl/style/fonts/Open Sans Regular,Arial Unicode MS Regular/12288-12543.pbfView on unpkg
package.jsonView file
•dependencies registry_only=@antv/l7
Critical
Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg
29patternName = npm_token severity = critical line = 29 matchedText = "publish...F ",
Critical
Secret Pattern

npm access token in package.json

package.jsonView on unpkg · L29
30patternName = npm_token severity = critical line = 30 matchedText = "publish...F ",
Critical
Secret Pattern

npm access token in package.json

package.jsonView on unpkg · L30
31patternName = npm_token severity = critical line = 31 matchedText = "publish...2F "
Critical
Secret Pattern

npm access token in package.json

package.jsonView on unpkg · L31
baseSetting/utils/TokenUtils.jsView file
10patternName = supabase_service_key severity = critical line = 10 matchedText = Cesium_A...fc',
Critical
Secret Pattern

Supabase service role key (JWT) in baseSetting/utils/TokenUtils.js

baseSetting/utils/TokenUtils.jsView on unpkg · L10

Findings

7 Critical1 High3 Medium3 Low
CriticalCritical Secretmapboxgl/utils/mapbox_native.js
CriticalManifest Confusionpackage.json
CriticalSecret Patternmapboxgl/utils/mapbox_native.js
CriticalSecret Patternpackage.json
CriticalSecret Patternpackage.json
CriticalSecret Patternpackage.json
CriticalSecret PatternbaseSetting/utils/TokenUtils.js
HighShips High Entropy Blobmapboxgl/style/fonts/Open Sans Regular,Arial Unicode MS Regular/12288-12543.pbf
MediumNetwork
MediumShips Build HelperbaseSetting/style/getDefaultFonts.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings