registry / iflow-engine-base / 3.12.6
iflow-engine-base@3.12.6
⚠ Under reviewBIM Engine SDK for Vue2, Vue3, React and HTML
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Oversized source lightweight scan
dist/Cesium/Cesium.js5.57 MB file, sampled 256 KB
HighEntropyStringsMinified
dist/Cesium/index.cjs4.44 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringsinstagram.com
Source & flagged code
7 flaggeddist/chunks/sdk-vendor-DEyo-iP-.jsView file
2274}, m.setImmediate = function(E) {
L2275: typeof E != "function" && (E = new Function("" + E));
L2276: for (var T = new Array(arguments.length - 1), C = 0; C < T.length; C++) T[C] = arguments[C + 1];
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/chunks/sdk-vendor-DEyo-iP-.jsView on unpkg · L2274dist/draco/draco_decoder.jsView file
7L8: var Module=typeof DracoDecoderModule!="undefined"?DracoDecoderModule:{};var readyPromiseResolve,readyPromiseReject;Module["ready"]=new Promise(function(resolve,reject){readyPromise...
L9: // EMSCRIPTEN_START_ASM
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/draco/draco_decoder.jsView on unpkg · L7dist/chunks/engine-3d-x-tblBYc.jsView file
Findings
2 Critical1 High5 Medium7 Low
CriticalTrojan Source Unicodedist/chunks/engine-3d-x-tblBYc.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/engine-3d-x-tblBYc.js
HighShips High Entropy Blobdist/assets/hdr/17.hdr
MediumDynamic Requiredist/draco/draco_decoder.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/chunks/sdk-vendor-DEyo-iP-.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to iflow-engine-base@3.12.6.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@3.12.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.