registry / md-components-mdigial-azamat / 0.0.314

md-components-mdigial-azamat@0.0.314

⚠ Under review

npm version patch npm run build npm publish

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 854 file(s), 2.75 MB of source, external domains: api.example.com, api.whatsapp.com, app.mbank.kg, apps.apple.com, cdn-icons-png.flaticon.com, cdn.tailwindcss.com, developer.mozilla.org, example.com, facebook.com, fb.me, github.com, hub.mbank.kg, images.unsplash.com, img.youtube.com, instagram.com, linkedin.com, mbank.kg, murabaha.mbank.kg, picsum.photos, play.google.com, prosemirror.net, s-c.sh, styled-components.com, t.me, upload.wikimedia.org, w3c.github.io, wallpapercave.com, www.google.com, www.styled-components.com, www.w3.org, www.youtube.com

Source & flagged code

3 flagged

dist/CustomCalculator/hooks/useCalculator.jsView file

Lines 184-224javascript

184 () => h.reduce((t, n) => {

185 const e = d(

186 n.sourceField,

187 n.datasetFieldKey,

188 c

189 );

190 return t[n.variable] = e === void 0 ? "" : e, t;

191 }, {}),

192 [h, d, c]

193 ), B = y((t, n) => {

194 v((e) => ({

195 ...e,

196 [t]: n === "" ? "" : n

197 }));

198 }, []), M = $(() => {

199 const t = {}, n = [

200 ...i.map((e) => e.variable),

201 ...h.map((e) => e.variable)

202 ];

203 return R.forEach((e) => {

204 try {

205 t[e.id] = new Function(...n, `return ${e.expression}`);

206 } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/CustomCalculator/hooks/useCalculator.jsView on unpkg · L204

207 t[e.id] = () => 0;

208 }

209 }), { keys: n, fns: t };

210 }, [h, i, R]), E = y(

211 (t) => {

212 try {

213 const { keys: n, fns: e } = M, a = e[t];

214 if (!a)

215 return 0;

216 const r = {

217 ...c,

218 ...D

219 };

220 i.forEach((o) => {

221 f(o, r) || (r[o.variable] = 0);

222 });

223 const u = n.map((o) => S(r[o], 0)), s = a(...u);

224 return isNaN(s) || !isFinite(s) ? 0 : s;

dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView file

1557contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView on unpkg · L1557

dist/assets/Inter-Medium.woff2View file

•path = dist/assets/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 108096 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/Inter-Medium.woff2View on unpkg

Source & flagged code

3 flagged · loading source

dist/CustomCalculator/hooks/useCalculator.jsView file

204try { L205: t[e.id] = new Function(...n, `return ${e.expression}`); L206: } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/CustomCalculator/hooks/useCalculator.jsView on unpkg · L204

dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView file

1557contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView on unpkg · L1557

dist/assets/Inter-Medium.woff2View file

•path = dist/assets/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 108096 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/Inter-Medium.woff2View on unpkg

Findings

1 Critical1 High3 Medium6 Low

CriticalTrojan Source Unicodedist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.js

HighShips High Entropy Blobdist/assets/Inter-Medium.woff2

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/CustomCalculator/hooks/useCalculator.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/CustomCalculator/hooks/useCalculator.jsView file

Lines 184-224javascript

184 () => h.reduce((t, n) => {

185 const e = d(

186 n.sourceField,

187 n.datasetFieldKey,

188 c

189 );

190 return t[n.variable] = e === void 0 ? "" : e, t;

191 }, {}),

192 [h, d, c]

193 ), B = y((t, n) => {

194 v((e) => ({

195 ...e,

196 [t]: n === "" ? "" : n

197 }));

198 }, []), M = $(() => {

199 const t = {}, n = [

200 ...i.map((e) => e.variable),

201 ...h.map((e) => e.variable)

202 ];

203 return R.forEach((e) => {

204 try {

205 t[e.id] = new Function(...n, `return ${e.expression}`);

206 } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/CustomCalculator/hooks/useCalculator.jsView on unpkg · L204

207 t[e.id] = () => 0;

208 }

209 }), { keys: n, fns: t };

210 }, [h, i, R]), E = y(

211 (t) => {

212 try {

213 const { keys: n, fns: e } = M, a = e[t];

214 if (!a)

215 return 0;

216 const r = {

217 ...c,

218 ...D

219 };

220 i.forEach((o) => {

221 f(o, r) || (r[o.variable] = 0);

222 });

223 const u = n.map((o) => S(r[o], 0)), s = a(...u);

224 return isNaN(s) || !isFinite(s) ? 0 : s;

dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView file

1557contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView on unpkg · L1557

dist/assets/Inter-Medium.woff2View file

•path = dist/assets/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 108096 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/Inter-Medium.woff2View on unpkg