registry  /  leiting-bim  /  2.2.5

leiting-bim@2.2.5

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 33 file(s), 7.02 MB of source, external domains: api.tianditu.gov.cn, echarts.apache.org, elevation3d.arcgis.com, github.com, leiting.chenxisoft.com, server.arcgisonline.com, www.w3.org

Source & flagged code

5 flagged · loading source
index-HGvoESav.jsView file
8patternName = supabase_service_key severity = critical line = 8 matchedText = accessTo...FpU"
Critical
Critical Secret

Package contains a critical-looking secret pattern.

index-HGvoESav.jsView on unpkg · L8
8patternName = supabase_service_key severity = critical line = 8 matchedText = accessTo...FpU"
Critical
Secret Pattern

Supabase service role key (JWT) in index-HGvoESav.js

index-HGvoESav.jsView on unpkg · L8
plugins/cesium-vue/dist/index-McKGafjp.jsView file
23773function n6(r) { L23774: return U(r) ? typeof JSON < "u" && JSON.parse ? JSON.parse(r) : new Function("return (" + r + ");")() : r; L23775: }
Low
Eval

Package source references a known benign dynamic code generation pattern.

plugins/cesium-vue/dist/index-McKGafjp.jsView on unpkg · L23773
leiting-bim.es.jsView file
1(function(_0x129e4b,_0x4f52b2){var _0x2965e0=a0_0x1f44,_0x5ed904=_0x129e4b();while(!![]){try{var _0x1ef076=-parseInt(_0x2965e0(0x14d))/0x1*(-parseInt(_0x2965e0(0x148))/0x2)+-parseI...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

leiting-bim.es.jsView on unpkg · L1
leiting-bim.umd.jsView file
1patternName = supabase_service_key severity = critical line = 1 matchedText = (functio...te(`
Critical
Secret Pattern

Supabase service role key (JWT) in leiting-bim.umd.js

leiting-bim.umd.jsView on unpkg · L1

Findings

3 Critical2 High3 Medium5 Low
CriticalCritical Secretindex-HGvoESav.js
CriticalSecret Patternindex-HGvoESav.js
CriticalSecret Patternleiting-bim.umd.js
HighObfuscated Payload Loaderleiting-bim.es.js
HighObfuscated
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvalplugins/cesium-vue/dist/index-McKGafjp.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License