registry / hazo_collab_forms / 6.26.1

hazo_collab_forms@6.26.1

Collaboration form elements

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 362 file(s), 2.12 MB of source, external domains: accounts.google.com, sheets.googleapis.com, www.googleapis.com, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 45-85json

45 "./styles/spacer.css": "./styles/spacer.css"

46 },

47 "files": [

48 "dist",

49 "styles",

50 "templates",

51 "CHANGE_LOG.md",

52 "LICENSE"

53 ],

54 "bin": {

55 "hazo-collab-forms-verify": "./dist/bin/verify-setup.js",

56 "hazo-collab-forms-setup": "./dist/bin/setup-shadcn.js"

57 },

58 "scripts": {

59 "build": "tsc -p tsconfig.build.json",

60 "dev:package": "tsc -p tsconfig.build.json --watch",

61 "dev:test-app": "npm run build && cd test-app && npm run dev",

62 "build:test-app": "npm run build && cd test-app && npm run build",

63 "clean": "rm -rf dist",

64 "prepublishOnly": "npm run clean && npm run build",

65 "postinstall": "node dist/bin/postinstall.js 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L65

66 "test": "vitest run",

67 "test:watch": "vitest"

68 },

69 "keywords": [

70 "collaboration",

71 "forms",

72 "react",

73 "nextjs",

74 "typescript",

75 "tailwind",

76 "shadcn",

77 "chat",

78 "file-upload",

79 "form-builder"

80 ],

81 "engines": {

82 "node": ">=18.0.0"

83 },

84 "author": "Pubs Abayasiri",

85 "license": "MIT",

dist/utils/formula.jsView file

Lines 18-58javascript

18 }

19 let sum = 0;

20 for (const row of table_data) {

21 if (typeof row === "object" && row !== null) {

dist/utils/icon_loader.jsView file

Lines 63-103javascript

63 * const Icon = await load_icon('IoCheckmarkCircle', 'io5');

64 * if (Icon) {

65 * return <Icon className="h-5 w-5" />;

66 *

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/utils/formula.jsView file

38* Only supports: numbers, +, -, *, /, parentheses, whitespace, decimal points L39: * This avoids using eval() or new Function() for security L40: */

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/utils/formula.jsView on unpkg · L38

dist/utils/icon_loader.jsView file

83// Dynamic import of the icon set module L84: const module = await import(/* webpackIgnore: true */ module_path); L85: icon_module_cache[icon_set] = module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/icon_loader.jsView on unpkg · L83

Findings

1 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/utils/icon_loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/utils/formula.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 45-85json

45 "./styles/spacer.css": "./styles/spacer.css"

46 },

47 "files": [

48 "dist",

49 "styles",

50 "templates",

51 "CHANGE_LOG.md",

52 "LICENSE"

53 ],

54 "bin": {

55 "hazo-collab-forms-verify": "./dist/bin/verify-setup.js",

56 "hazo-collab-forms-setup": "./dist/bin/setup-shadcn.js"

57 },

58 "scripts": {

59 "build": "tsc -p tsconfig.build.json",

60 "dev:package": "tsc -p tsconfig.build.json --watch",

61 "dev:test-app": "npm run build && cd test-app && npm run dev",

62 "build:test-app": "npm run build && cd test-app && npm run build",

63 "clean": "rm -rf dist",

64 "prepublishOnly": "npm run clean && npm run build",

65 "postinstall": "node dist/bin/postinstall.js 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L65

66 "test": "vitest run",

67 "test:watch": "vitest"

68 },

69 "keywords": [

70 "collaboration",

71 "forms",

72 "react",

73 "nextjs",

74 "typescript",

75 "tailwind",

76 "shadcn",

77 "chat",

78 "file-upload",

79 "form-builder"

80 ],

81 "engines": {

82 "node": ">=18.0.0"

83 },

84 "author": "Pubs Abayasiri",

85 "license": "MIT",

dist/utils/formula.jsView file

Lines 18-58javascript

18 }

19 let sum = 0;

20 for (const row of table_data) {

21 if (typeof row === "object" && row !== null) {

dist/utils/icon_loader.jsView file

Lines 63-103javascript

63 * const Icon = await load_icon('IoCheckmarkCircle', 'io5');

64 * if (Icon) {

65 * return <Icon className="h-5 w-5" />;

66 *