registry / iflow-engine-base / 3.12.8
iflow-engine-base@3.12.8
⚠ Under reviewBIM Engine SDK for Vue2, Vue3, React and HTML
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Oversized source lightweight scan
dist/Cesium/Cesium.js5.57 MB file, sampled 256 KB
HighEntropyStringsMinified
dist/Cesium/index.cjs4.44 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringsinstagram.com
Source & flagged code
7 flaggeddist/Cesium/Workers/transcodeKTX2.jsView file
25L26: import{a as on}from"./chunk-XR7MN4PJ.js";import{a as f}from"./chunk-DC3K7YTH.js";import{a as se}from"./chunk-PQ3V63XF.js";import{b as sn}from"./chunk-GF67PEXE.js";import{a as Vt,c ...
L27: "use strict"; return body.apply(this, arguments);
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/Cesium/Workers/transcodeKTX2.jsView on unpkg · L25dist/draco/draco_decoder.jsView file
7L8: var Module=typeof DracoDecoderModule!="undefined"?DracoDecoderModule:{};var readyPromiseResolve,readyPromiseReject;Module["ready"]=new Promise(function(resolve,reject){readyPromise...
L9: // EMSCRIPTEN_START_ASM
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/draco/draco_decoder.jsView on unpkg · L7dist/chunks/engine-3d-TWmZYMpz.js
Findings
2 Critical1 High5 Medium6 Low
CriticalTrojan Source Unicodedist/chunks/engine-3d-TWmZYMpz.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/engine-3d-TWmZYMpz.js
HighShips High Entropy Blobdist/assets/hdr/17.hdr
MediumDynamic Requiredist/draco/draco_decoder.js
MediumNetwork
MediumShips Wasm Moduledist/draco/draco_decoder.wasm
MediumOversized Source Filedist/bim-engine-sdk.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/Cesium/Workers/transcodeKTX2.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to iflow-engine-base@3.12.8.
See all versions of iflow-engine-base for other recorded verdicts.
- Review the evidence and your use of iflow-engine-base@3.12.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.