registry / jufubao-base / 1.0.398-beta4

jufubao-base@1.0.398-beta4

聚福宝业务组件基础插件包

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 536 file(s), 2.71 MB of source, external domains: api.map.baidu.com, gw.alicdn.com, img1.jufubao.cn, img1.winxuancdn.com, img2.jufubao.cn, img2.winxuancdn.com, img3.winxuancdn.com, jfb-public-images.oss-cn-qingdao.aliyuncs.com, jfbcake.oss-cn-beijing.aliyuncs.com, registry.npm.taobao.org, registry.npmmirror.com, sandbox-img.jufubao.cn, sandbox-img2.jufubao.cn, sandbox-website-05.jufubao.cn, thirdwx.qlogo.cn, www.iconfont.cn

Source & flagged code

4 flagged

commands.all.jsView file

Lines 1-69javascript

1'use strict';

3const path = require('path');

4const basePath = require('./build/path');

5const clog = require('./build/clog');

6const fileHelper = require('./build/fileHepler');

7let fromBuildPath = path.resolve('./node_modules/gxd-commands-bussiness/build');

8let fromCommandsPath = path.resolve('./node_modules/gxd-commands-bussiness/commands');

9const utils = require('./build/lib/utils');

10const execSync = require('child_process').execSync;

11const getPackage = `${basePath.buildRoot}/get.package.path.js`;

High

Child Process

Package source references child process execution.

commands.all.jsView on unpkg · L9

13//业务项目ID

14const projectPathList = [

15 {

16 name: '业务基础初始化库',

17 path: '/Users/shiyonggao/Desktop/code/BASE/UNIAPP/xd-bussiness-base'

18 },

19 {

20 name: '业务组件基础插件库',

21 path: '/Users/shiyonggao/Desktop/code/JFB/package/jufubao-base'

22 },

23 {

24 name: '业务组件商城库',

25 path: '/Users/shiyonggao/Desktop/code/JFB/package/jufubao-mall'

26 },

27 {

28 name: '业务组件在线选座库',

29 path: '/Users/shiyonggao/Desktop/code/JFB/package/jufubao-movie'

30 },

31 {

32 name: '业务组件核销库',

33 path: '//Users/shiyonggao/Desktop/code/JFB/package/jufubao-cashier'

34 },

35];

37const init = ()=>{

38 //判断是否从本地获取数据

39 let isLocal = process.env.isLocal === 'true';

40 if (isLocal && fileHelper.existFileSync(getPackage)) {

41 const {getPackagePath} = require(getPackage);

42 fromBuildPath = fileHelper.getPlatformSurePath(getPackagePath('/build', 'gxd-commands-bussiness'));

43 fromCommandsPath = fileHelper.getPlatformSurePath(getPackagePath('/commands', 'gxd-commands-bussiness'));

44 }

46 //获取需要拷贝的项目路径

47 clog(`开始更新项目`, 'cyanBG');

49 //更新包

50 execSync(`npm i --registry=https://registry.npm.taobao.org`, {stdio: 'inherit'});

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

commands.all.jsView on unpkg · L49

52 //复制命令行

53 // projectPathList.map(item=>{

54 // let toBuildPath = `${item.path}/build`;

55 // let toCommandsPath = `${item.path}/commands`;

56 // fileHelper.copySync(fromBuildPath, toBuildPath);

57 // fileHelper.copySync(fromCommandsPath, toCommandsPath);

58 // clog(`拷贝命令行操作成功，目录:${toBuildPath}`, 'green');

59 // clog(`拷贝命令行操作成功，目录:${toCommandsPath}`, 'green');

60 // });

62 //初始化插件库

63 utils.logsLine(clog,'start');

64 clog(`开始初始化项目框架逻辑`, 'cyanBG');

65 projectPathList.map(item=>{

66 clog(`开始：${item.name}`, 'redBG');

67 clog(`目录:${fileHelper.getPlatformSurePath(item.path)}`, 'green');

68 execSync(`cd ${item.path} && cross-env oss=true node ./build/commands/copy.init.js`, {stdio: 'inherit'});

69 utils.logsLine(clog);

src/components/JfbBaseSavingDetail/components/echarts.min.jsView file

4null!=t.hoverAnimation&&(t.emphasis=t.emphasis||{},t.emphasis&&null==t.emphasis.scale&&(t.emphasis.scale=t.hoverAnimation)),gu(t)}}),t.dataRange&&(t.visualMap=t.dataRange),y(xP,fun... L5: }return e.UTF8Encoding=!1,e}function ip(t,e,n){for(var i=[],r=e[0],o=e[1],a=0;a<t.length;a+=2){var s=t.charCodeAt(a)-64,l=t.charCodeAt(a+1)-64;s=s>>1^-(1&s),l=l>>1^-(1&l),s+=r,l+=o... L6: }function Wf(t,e,n){for(var i=0;i<n.length;i++){var r=n[i];null!=e[r]&&(t[r]=e[r])}}function Xf(t){t.registerUpdateLifecycle("series:beforeupdate",function(t,e){var n=fz(e).labelMa...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/components/JfbBaseSavingDetail/components/echarts.min.jsView on unpkg · L4

commands.update.change.jsView file

Lines 1-22javascript

1'use strict';

3const path = require('path');

4const basePath = require('./build/path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

commands.update.change.jsView on unpkg · L2

5const clog

Source & flagged code

4 flagged · loading source

commands.all.jsView file

9const utils = require('./build/lib/utils'); L10: const execSync = require('child_process').execSync; L11: const getPackage = `${basePath.buildRoot}/get.package.path.js`;

High

Child Process

Package source references child process execution.

commands.all.jsView on unpkg · L9

49//更新包 L50: execSync(`npm i --registry=https://registry.npm.taobao.org`, {stdio: 'inherit'}); L51:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

commands.all.jsView on unpkg · L49

src/components/JfbBaseSavingDetail/components/echarts.min.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/components/JfbBaseSavingDetail/components/echarts.min.jsView on unpkg · L4

commands.update.change.jsView file

2L3: const path = require('path'); L4: const basePath = require('./build/path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

commands.update.change.jsView on unpkg · L2

Findings

2 High4 Medium6 Low

HighChild Processcommands.all.js

HighRuntime Package Installcommands.all.js

MediumDynamic Requirecommands.update.change.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvalsrc/components/JfbBaseSavingDetail/components/echarts.min.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

commands.all.jsView file

Lines 1-69javascript

1'use strict';

3const path = require('path');

4const basePath = require('./build/path');

5const clog = require('./build/clog');

6const fileHelper = require('./build/fileHepler');

7let fromBuildPath = path.resolve('./node_modules/gxd-commands-bussiness/build');

8let fromCommandsPath = path.resolve('./node_modules/gxd-commands-bussiness/commands');

9const utils = require('./build/lib/utils');

10const execSync = require('child_process').execSync;

11const getPackage = `${basePath.buildRoot}/get.package.path.js`;

High

Child Process

Package source references child process execution.

commands.all.jsView on unpkg · L9

13//业务项目ID

14const projectPathList = [

15 {

16 name: '业务基础初始化库',

17 path: '/Users/shiyonggao/Desktop/code/BASE/UNIAPP/xd-bussiness-base'

18 },

19 {

20 name: '业务组件基础插件库',

21 path: '/Users/shiyonggao/Desktop/code/JFB/package/jufubao-base'

22 },

23 {

24 name: '业务组件商城库',

25 path: '/Users/shiyonggao/Desktop/code/JFB/package/jufubao-mall'

26 },

27 {

28 name: '业务组件在线选座库',

29 path: '/Users/shiyonggao/Desktop/code/JFB/package/jufubao-movie'

30 },

31 {

32 name: '业务组件核销库',

33 path: '//Users/shiyonggao/Desktop/code/JFB/package/jufubao-cashier'

34 },

35];

37const init = ()=>{

38 //判断是否从本地获取数据

39 let isLocal = process.env.isLocal === 'true';

40 if (isLocal && fileHelper.existFileSync(getPackage)) {

41 const {getPackagePath} = require(getPackage);

42 fromBuildPath = fileHelper.getPlatformSurePath(getPackagePath('/build', 'gxd-commands-bussiness'));

43 fromCommandsPath = fileHelper.getPlatformSurePath(getPackagePath('/commands', 'gxd-commands-bussiness'));

44 }

46 //获取需要拷贝的项目路径

47 clog(`开始更新项目`, 'cyanBG');

49 //更新包

50 execSync(`npm i --registry=https://registry.npm.taobao.org`, {stdio: 'inherit'});

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

commands.all.jsView on unpkg · L49

52 //复制命令行

53 // projectPathList.map(item=>{

54 // let toBuildPath = `${item.path}/build`;

55 // let toCommandsPath = `${item.path}/commands`;

56 // fileHelper.copySync(fromBuildPath, toBuildPath);

57 // fileHelper.copySync(fromCommandsPath, toCommandsPath);

58 // clog(`拷贝命令行操作成功，目录:${toBuildPath}`, 'green');

59 // clog(`拷贝命令行操作成功，目录:${toCommandsPath}`, 'green');

60 // });

62 //初始化插件库

63 utils.logsLine(clog,'start');

64 clog(`开始初始化项目框架逻辑`, 'cyanBG');

65 projectPathList.map(item=>{

66 clog(`开始：${item.name}`, 'redBG');

67 clog(`目录:${fileHelper.getPlatformSurePath(item.path)}`, 'green');

68 execSync(`cd ${item.path} && cross-env oss=true node ./build/commands/copy.init.js`, {stdio: 'inherit'});

69 utils.logsLine(clog);

src/components/JfbBaseSavingDetail/components/echarts.min.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/components/JfbBaseSavingDetail/components/echarts.min.jsView on unpkg · L4

commands.update.change.jsView file

Lines 1-22javascript

1'use strict';

3const path = require('path');

4const basePath = require('./build/path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

commands.update.change.jsView on unpkg · L2

5const clog