mfm-widget-newer@15.2.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

mfm-widget-newer@15.2.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/chunks/widget-CNZuvRd2.jsView file

•Browser cookie sent to a fixed external endpoint in dist/chunks/widget-CNZuvRd2.js: */var zh;function j1(){if(zh)return vt;zh=1;var n=ru();function i(b){var m="https://react.dev/errors/"+b;if(1<arguments.length){m+="?args[]="+encodeURIComponent(arguments[1]);for(v... */var Th;function V1(){if(Th)return Pi;Th=1;var n=W1(),i=ru(),l=Ph();function a(e){var t="https://react.dev/errors/"+e;if(1<arguments.length){t+="?args[]="+encodeURIComponent(argum... `+o.stack}}var Ar=Object.prototype.hasOwnProperty,Fr=n.unstable_scheduleCallback,qr=n.unstable_cancelCallback,el=n.unstable_shouldYield,tl=n.unstable_requestPaint,bt=n.unstable_now... `).replace(i1,"")}function qg(e,t){return t=Fg(t),Fg(e)===t}function Ue(e,t,r,o,s,c){switch(r){case"children":typeof o=="string"?t==="body"||t==="textarea"&&o===""|

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunks/widget-CNZuvRd2.jsView on unpkg

59const km="MFM_CLIENT_ID";class Mx{constructor(){cr(this,"enabled",!0),cr(this,"token",null),cr(this,"organisationId",null),cr(this,"clientType","NPM"),cr(this,"clientId",""),cr(this,"initialized",!1)}

High

Ai Review Evidence

The widget initializes analytics as enabled and sends its stored token, organisation identifier, client ID, event name, and event values to the vendor API.

dist/chunks/widget-CNZuvRd2.jsView on unpkg · L59

59track(i,l){if(typeof window>"u"||!this.enabled||!this.token)return;this.initialized||this.init();const a={eventName:i,clientId:this.clientId,value:{xo:this.organisationId||"",ux:"",clientType:this.clientType,...l??{}}},d=`${Bt.baseUrl}/analytics/cli`;try{fetch(d,{method:"POST",headers:{"Content-Type":"application/json",mockforme:this.token,"x-mfm-internal":"true"},body:JSON.stringify(a),credentials:"omit",keepalive:!0}).catch(()=>{})}catch{}}

High

Ai Review Evidence

The widget initializes analytics as enabled and sends its stored token, organisation identifier, client ID, event name, and event values to the vendor API.

dist/chunks/widget-CNZuvRd2.jsView on unpkg · L59

59function qx(){try{const n=localStorage.getItem(Xm);return n==null?!0:n==="true"}catch{return!0}}

High

Ai Review Evidence

An absent analytics preference is treated as enabled, so this transmission can occur without an explicit opt-in.

dist/chunks/widget-CNZuvRd2.jsView on unpkg · L59

297`:"",";",""),children:[u("div",{css:y("display:flex;justify-content:flex-end;padding:",f.spacing.xs," ",f.spacing.sm,";border-bottom:1px solid ",f.color.border,";background:",f.col... L298: `:return"Enter";default:return"Unidentified"}}function nE(n,i,l=i){const a={...Lr(),key:i,code:l};n.dispatchEvent(new KeyboardEvent("keydown",a)),n.dispatchEvent(new KeyboardEvent(... L299: 0% { transform: translateX(-100%) scaleX(0.4); }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/widget-CNZuvRd2.jsView on unpkg · L297

dist/chunks/JsonEditorLazyBundle-fQQsByNB.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/JsonEditorLazyBundle-fQQsByNB.jsView on unpkg

Source & flagged code

6 flagged

dist/chunks/widget-CNZuvRd2.jsView file

Lines 39-79javascript

39Error generating stack: `+o.message+`

40`+o.stack}}var Ar=Object.prototype.hasOwnProperty,Fr=n.unstable_scheduleCallback,qr=n.unstable_cancelCallback,el=n.unstable_shouldYield,tl=n.unstable_requestPaint,bt=n.unstable_now,nl=n.unstable_getCurrentPriorityLevel,Ro=n.unstable_ImmediatePriority,rl=n.unstable_UserBlockingPriority,ce=n.unstable_NormalPriority,Se=n.unstable_LowPriority,Jt=n.unstable_IdlePriority,vb=n.log,xb=n.unstable_setDisableYieldValue,Ao=null,Nt=null;function Fn(e){if(typeof vb=="function"&&xb(e),Nt&&typeof Nt.setStrictMode=="function")try{Nt.setStrictMode(Ao,e)}catch{}}var Lt=Math.clz32?Math.clz32:Sb,wb=Math.log,kb=Mat ...

41`).replace(i1,"")}function qg(e,t){return t=Fg(t),Fg(e)===t}function Ue(e,t,r,o,s,c){switch(r){case"children":typeof o=="string"?t==="body"||t==="textarea"&&o===""||Qr(e,o):(typeof o=="number"||typeof o=="bigint")&&t!=="body"&&Qr(e,""+o);break;case"className":cl(e,"class",o);break;case"tabIndex":cl(e,"tabindex",o);break;case"dir":case"role":case"viewBox":case"width":case"height":cl(e,r,o);break;case"style":Fd(e,o,c);break;case"data":if(t!=="object"){cl(e,"data",o);break}case"src":case"href":if(o===""&&(t!=="a"||r!=="href")){e.removeAttribute(r);break}if(o==null||typeof o=="function"||typeof o= ...

42 * react-is.production.min.js

43 *

44 * Copyright (c) Facebook, Inc. and its affiliates.

45 *

46 * This source code is licensed under the MIT license found in the

47 * LICENSE file in the root directory of this source tree.

48 */var Vh;function Sv(){if(Vh)return Re;Vh=1;var n=typeof Symbol=="function"&&Symbol.for,i=n?Symbol.for("react.element"):60103,l=n?

49 * @license React

50 * react-jsx-runtime.production.js

51 *

52 * Copyright (c) Meta Platforms, Inc. and affiliates.

53 *

54 * This source code is licensed under the MIT license found in the

55 * LICENSE file in the root directory of this source tree.

56 */var am;function Bv(){if(am)return Fi;am=1;var n=Symbol.for("react.transitional.element"),i=Symbol.for("react.fragment");function l(a,d,

57 from { transform: translateY(8px); opacity: 0; }

58 to { transform: translateY(0); opacity: 1; }

59`;var um;(function(n){n[n.NONE=0]="NONE",n[n.INFO=1]="INFO",n[n.WARN=2]="WARN",n[n.ERROR=3]="ERROR"})(um||(um={}));var he;(function(n){n.MFM_REQ_MAPPINGS="MFM_REQ_MAPPINGS",n.MFM_REQ_SAVED_MAPPINGS="MFM_REQ_SAVED_MAPPINGS",n.MFM_DEL_CLIENT_TOKEN="MFM_DEL_CLIENT_TOKEN",n.MFM_SUBMIT_TOKEN="MFM_SUBMIT_TOKEN",n.MFM_TOGGLE_INTERCEPTION="MFM_TOGGLE_INTERCEPTION",n.MFM_REQ_ALL_APIS="MFM_REQ_ALL_APIS",n.MFM_TOGGLE_API="MFM_TOGGLE_API",n.MFM_DEBUG_RULES_UPDATE="MFM_DEBUG_RULES_UPDATE",n.MFM_DEBUG_INTERCEPT_RES="MFM_DEBUG_INTERCEPT_RES",n.MFM_REQUEST_EDIT_RULES_UPDATE="MFM_REQUEST_EDIT_RULES_UPDATE",n.M ...

High

Ai Review Evidence

The widget initializes analytics as enabled and sends its stored token, organisation identifier, client ID, event name, and event values to the vendor API.

dist/chunks/widget-CNZuvRd2.jsView on unpkg · L59

High

Ai Review Evidence

The widget initializes analytics as enabled and sends its stored token, organisation identifier, client ID, event name, and event values to the vendor API.

dist/chunks/widget-CNZuvRd2.jsView on unpkg · L59

High

Ai Review Evidence

An absent analytics preference is treated as enabled, so this transmission can occur without an explicit opt-in.

dist/chunks/widget-CNZuvRd2.jsView on unpkg · L59

60 * @license lucide-react v0.460.0 - ISC

61 *

62 * This source code is licensed under the ISC license.

63 * See the LICENSE file in the root directory of this source tree.

64 */const Gx=n=>n.replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase(),ty=(...n)=>n.filter((i,l,a)=>!!i&&i.trim()!==""&&a.indexOf(i)===l).join(" ").trim();/**

65 * @license lucide-react v0.460.0 - ISC

66 *

67 * This source code is licensed under the ISC license.

68 * See the LICENSE file in the root directory of this source tree.

69 */var Jx={xmlns:"http://www.w3.org/2000/svg",width:24,height:24,viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:2,strokeLinecap:"round",strokeLinejoin:"round"};/**

70 * @license lucide-react v0.460.0 - ISC

71 *

72 * This source code is licensed under the ISC license.

73 * See the LICENSE file in the root directory of this source tree.

74 */const Zx=h.forwardRef(({color:n="currentColor",size:i=24,strokeWidth:l=2,absoluteStrokeWidth:a,className:d="",children:f,iconNode:g,...x},b)=>h.createElement("svg",{ref:b,...Jx,width:i,height:i,stroke:n,strokeWidth:a?Number(l)*24/Number(i):l,className:ty("lucide",d),...x},[...g.map(([m,k])=>h.createElement(m,k)),...Array.isArray(f)?f:[f]]));/**

75 * @license lucide-react v0.460.0 - ISC

76 *

77 * This source code is licensed under the ISC license.

78 * See the LICENSE file in the root directory of this source tree.

79 */const Te=(n,i)=>{const l=h.forwardRef(({className:a,...d},f)=>h.createElement(Zx,{ref:f,iconNode:i,className:ty(`lucide-${Gx(n)}`,a),...d}));return l.displayName=`${n}`,l};/**

Long lines were clipped for display.

Lines 277-303javascript

277 0 0 0 0 rgba(15, 131, 255, 0); }

278`,vk=4;var xk={name:"f53ey4",styles:"animation:spin 0.9s linear infinite;@keyframes spin{to{transform:rotate(360deg);}}"};function Ru({children:n}){const i=J(),{isOpen:l,setOpen:a,surface:d,pillPosition:f,setPillPosition:g,isSnippingActive:x,dockX:b,viewportW:m}=He(),k=parseInt(String(i.surface.margin),10)||24,w=Math.max(0,m-d.width-k*2),C=Math.round(k+b*w),q=y("left:",C,"px;right:auto;",""),{reloadMappings:N,isLoading:z,token:L}=wt();if(x)return null;const P=h.useRef(null),R=h.useRef(null),U=h.useCallback(W=>{if(W.target.closest("[data-pill-action]"))return;const _=W.currentTarget,K=_.getBoun ...

279 to { transform: rotate(360deg); }

280

•Browser cookie sent to a fixed external endpoint in dist/chunks/widget-CNZuvRd2.js: */var zh;function j1(){if(zh)return vt;zh=1;var n=ru();function i(b){var m="https://react.dev/errors/"+b;if(1<arguments.length){m+="?args[]="+encodeURIComponent(arguments[1]);for(v... */var Th;function V1(){if(Th)return Pi;Th=1;var n=W1(),i=ru(),l=Ph();function a(e){var t="https://react.dev/errors/"+e;if(1<arguments.length){t+="?args[]="+encodeURIComponent(argum... `+o.stack}}var Ar=Object.prototype.hasOwnProperty,Fr=n.unstable_scheduleCallback,qr=n.unstable_cancelCallback,el=n.unstable_shouldYield,tl=n.unstable_requestPaint,bt=n.unstable_now... `).replace(i1,"")}function qg(e,t){return t=Fg(t),Fg(e)===t}function Ue(e,t,r,o,s,c){switch(r){case"children":typeof o=="string"?t==="body"||t==="textarea"&&o===""|

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunks/widget-CNZuvRd2.jsView on unpkg

dist/chunks/JsonEditorLazyBundle-fQQsByNB.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/JsonEditorLazyBundle-fQQsByNB.jsView on unpkg