mfm-widget-newer@17.3.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

mfm-widget-newer@17.3.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/chunks/widget-B3QZlmvR.jsView file

•Browser cookie sent to a fixed external endpoint in dist/chunks/widget-B3QZlmvR.js: */var cm;function $v(){if(cm)return Ct;cm=1;var n=Tu();function o(b){var m="https://react.dev/errors/"+b;if(1<arguments.length){m+="?args[]="+encodeURIComponent(arguments[1]);for(v... */var pm;function Wv(){if(pm)return Wi;pm=1;var n=Uv(),o=Tu(),a=dm();function l(e){var t="https://react.dev/errors/"+e;if(1<arguments.length){t+="?args[]="+encodeURIComponent(argum... `+i.stack}}var Vr=Object.prototype.hasOwnProperty,qr=n.unstable_scheduleCallback,Hr=n.unstable_cancelCallback,ha=n.unstable_shouldYield,ma=n.unstable_requestPaint,St=n.unstable_now... `).replace(nv,"")}function wh(e,t){return t=xh(t),xh(e)===t}function qe(e,t,r,i,s,u){switch(r){case"children":typeof i=="string"?t==="body"||t==="textarea"&&i===""|

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunks/widget-B3QZlmvR.jsView on unpkg

59https://api.mockforme.com",clientProxyPath:"/mockforme",dashboardUrl:"https://dashboard.mockforme.com"},ty={read(n){try{return localStorage.getItem(n)}catch{return null}},write(n,o

Medium

Ai Review Evidence

The widget chunk sets its API base to https://api.mockforme.com and dashboard to https://dashboard.mockforme.com, matching a MockForMe client.

dist/chunks/widget-B3QZlmvR.jsView on unpkg · L59

338`,";",""),children:[(n||p)&&w("div",{css:f("display:flex;align-items:center;gap:",l.spacing.sm,";justify-content:",p?"space-between":"flex-end",";padding:",l.spacing.xs," ",l.spaci... L339: `:return"Enter";default:return"Unidentified"}}function $E(n,o,a=o){const l={...Wr(),key:o,code:a};n.dispatchEvent(new KeyboardEvent("keydown",l)),n.dispatchEvent(new KeyboardEvent(... L340: 0% { transform: translateX(-100%) scaleX(0.4); }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/widget-B3QZlmvR.jsView on unpkg · L338

dist/chunks/JsonEditorLazyBundle-CO_RjMpQ.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/JsonEditorLazyBundle-CO_RjMpQ.jsView on unpkg

1import{g as it,r as Be,j as Ue,c as Ze,i as ot,G as rt,a as nt,F as st}from"./widget-B3QZlmvR.js";var Ke={exports:{}};/*! * jsoneditor.js * * @brief * JSONE

Medium

Ai Review Evidence

dist/chunks/JsonEditorLazyBundle-CO_RjMpQ.js is a jsoneditor bundle imported from the widget chunk, not an install-time payload.

dist/chunks/JsonEditorLazyBundle-CO_RjMpQ.jsView on unpkg · L1

package.jsonView file

1{ "name": "mfm-widget-newer", "version": "17.3.0", "type": "module", "description": "mfm-w", "main": "./dist/mfm-widget-new.es.js", "module": "./dist/mfm-widget-new.es.js", "types": "./dist/widget.d.ts",

Medium

Suspicious Lifecycle Evidence

package.json is an ESM widget with main and module pointing at dist/mfm-widget-new.es.js and has no install lifecycle scripts.

package.jsonView on unpkg · L1

Source & flagged code

6 flagged

dist/chunks/widget-B3QZlmvR.jsView file

•Browser cookie sent to a fixed external endpoint in dist/chunks/widget-B3QZlmvR.js: */var cm;function $v(){if(cm)return Ct;cm=1;var n=Tu();function o(b){var m="https://react.dev/errors/"+b;if(1<arguments.length){m+="?args[]="+encodeURIComponent(arguments[1]);for(v... */var pm;function Wv(){if(pm)return Wi;pm=1;var n=Uv(),o=Tu(),a=dm();function l(e){var t="https://react.dev/errors/"+e;if(1<arguments.length){t+="?args[]="+encodeURIComponent(argum... `+i.stack}}var Vr=Object.prototype.hasOwnProperty,qr=n.unstable_scheduleCallback,Hr=n.unstable_cancelCallback,ha=n.unstable_shouldYield,ma=n.unstable_requestPaint,St=n.unstable_now... `).replace(nv,"")}function wh(e,t){return t=xh(t),xh(e)===t}function qe(e,t,r,i,s,u){switch(r){case"children":typeof i=="string"?t==="body"||t==="textarea"&&i===""|

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/chunks/widget-B3QZlmvR.jsView on unpkg

59https://api.mockforme.com",clientProxyPath:"/mockforme",dashboardUrl:"https://dashboard.mockforme.com"},ty={read(n){try{return localStorage.getItem(n)}catch{return null}},write(n,o

Medium

Ai Review Evidence

The widget chunk sets its API base to https://api.mockforme.com and dashboard to https://dashboard.mockforme.com, matching a MockForMe client.

dist/chunks/widget-B3QZlmvR.jsView on unpkg · L59

338`,";",""),children:[(n||p)&&w("div",{css:f("display:flex;align-items:center;gap:",l.spacing.sm,";justify-content:",p?"space-between":"flex-end",";padding:",l.spacing.xs," ",l.spaci... L339: `:return"Enter";default:return"Unidentified"}}function $E(n,o,a=o){const l={...Wr(),key:o,code:a};n.dispatchEvent(new KeyboardEvent("keydown",l)),n.dispatchEvent(new KeyboardEvent(... L340: 0% { transform: translateX(-100%) scaleX(0.4); }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/widget-B3QZlmvR.jsView on unpkg · L338

dist/chunks/JsonEditorLazyBundle-CO_RjMpQ.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/JsonEditorLazyBundle-CO_RjMpQ.jsView on unpkg

1import{g as it,r as Be,j as Ue,c as Ze,i as ot,G as rt,a as nt,F as st}from"./widget-B3QZlmvR.js";var Ke={exports:{}};/*! * jsoneditor.js * * @brief * JSONE

Medium

Ai Review Evidence

dist/chunks/JsonEditorLazyBundle-CO_RjMpQ.js is a jsoneditor bundle imported from the widget chunk, not an install-time payload.

dist/chunks/JsonEditorLazyBundle-CO_RjMpQ.jsView on unpkg · L1

package.jsonView file

Lines 1-18json

1{

2 "name": "mfm-widget-newer",

3 "version": "17.3.0",

4 "type": "module",

5 "description": "mfm-w",

6