registry  /  leiting-bim  /  2.2.1

leiting-bim@2.2.1

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 33 file(s), 6.99 MB of source, external domains: api.tianditu.gov.cn, echarts.apache.org, elevation3d.arcgis.com, github.com, leiting.chenxisoft.com, server.arcgisonline.com, www.w3.org

Source & flagged code

5 flagged · loading source
index-B0x1Rmx-.jsView file
8patternName = supabase_service_key severity = critical line = 8 matchedText = accessTo...FpU"
Critical
Critical Secret

Package contains a critical-looking secret pattern.

index-B0x1Rmx-.jsView on unpkg · L8
8patternName = supabase_service_key severity = critical line = 8 matchedText = accessTo...FpU"
Critical
Secret Pattern

Supabase service role key (JWT) in index-B0x1Rmx-.js

index-B0x1Rmx-.jsView on unpkg · L8
plugins/cesium-vue/dist/index-McKGafjp.jsView file
23773function n6(r) { L23774: return U(r) ? typeof JSON < "u" && JSON.parse ? JSON.parse(r) : new Function("return (" + r + ");")() : r; L23775: }
Low
Eval

Package source references a known benign dynamic code generation pattern.

plugins/cesium-vue/dist/index-McKGafjp.jsView on unpkg · L23773
leiting-bim.es.jsView file
1function a0_0x1145(){var _0x409deb=['135112vAHYax','938760iEUjxp','363907MwSrNT','2703520QRezca','196oCFrBA','9efUBvu','339390OjNXhV','269622AwZbnT','29768391qfEkNq'];a0_0x1145=fun...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

leiting-bim.es.jsView on unpkg · L1
leiting-bim.umd.jsView file
1patternName = supabase_service_key severity = critical line = 1 matchedText = (functio...te(`
Critical
Secret Pattern

Supabase service role key (JWT) in leiting-bim.umd.js

leiting-bim.umd.jsView on unpkg · L1

Findings

3 Critical2 High3 Medium5 Low
CriticalCritical Secretindex-B0x1Rmx-.js
CriticalSecret Patternindex-B0x1Rmx-.js
CriticalSecret Patternleiting-bim.umd.js
HighObfuscated Payload Loaderleiting-bim.es.js
HighObfuscated
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvalplugins/cesium-vue/dist/index-McKGafjp.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License