registry / okno / 1.0.0-beta.27

okno@1.0.0-beta.27

⚠ Under review

Git-backed CMS with live editing for any Vite framework

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 22 file(s), 2.84 MB of source, external domains: api.github.com, api.okno.build, api.openai.com, bugzilla.mozilla.org, developer.mozilla.org, example.com, github.com, okno.build, openrouter.ai, player.vimeo.com, prosemirror.net, w3c.github.io, www.w3.org, www.youtube.com

Source & flagged code

2 flagged

dist/index-B2WzdTzI.jsView file

Lines 1535-1575javascript

1535 let o = [];

1536 for (let l = i; l.type; l = l.via)

1537 o.push(l.type);

1538 return o.reverse();

1539 }

1540 for (let o = 0; o < s.next.length; o++) {

1541 let { type: l, next: a } = s.next[o];

1542 !l.isLeaf && !l.hasRequiredAttrs() && !(l.name in t) && (!i.type || a.validEnd) && (r.push({ match: l.contentMatch, type: l, via: i }), t[l.name] = !0);

1543 }

1544 }

1545 return null;

1546 }

1547 /**

1548 The number of outgoing edges this node has in the finite

1549 automaton that describes the content expression.

1550 */

1551 get edgeCount() {

1552 return this.next.length;

1553 }

1554 /**

1555 Get the _n_th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index-B2WzdTzI.jsView on unpkg · L1555

1556 automaton that describes the content expression.

1557 */

1558 edge(e) {

1559 if (e >= this.next.length)

1560 throw new RangeError(`There's no ${e}th edge in this content match`);

1561 return this.next[e];

1562 }

1563 /**

1564 @internal

1565 */

1566 toString() {

1567 let e = [];

1568 function t(r) {

1569 e.push(r);

1570 for (let i = 0; i < r.next.length; i++)

1571 e.indexOf(r.next[i].next) == -1 && t(r.next[i].next);

1572 }

1573 return t(this), e.map((r, i) => {

1574 let s = i + (r.validEnd ? "*" : " ") + " ";

1575 for (let o = 0; o < r.next.length; o++)

•Trigger-reachable chain: manifest.exports -> dist/editor/index.js -> dist/index-B2WzdTzI.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-B2WzdTzI.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/index-B2WzdTzI.jsView file

1555contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index-B2WzdTzI.jsView on unpkg · L1555

•Trigger-reachable chain: manifest.exports -> dist/editor/index.js -> dist/index-B2WzdTzI.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-B2WzdTzI.jsView on unpkg

Findings

2 Critical4 Medium6 Low

CriticalTrojan Source Unicodedist/index-B2WzdTzI.js

CriticalTrigger Reachable Dangerous Capabilitydist/index-B2WzdTzI.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/index-B2WzdTzI.jsView file

Lines 1535-1575javascript

1535 let o = [];

1536 for (let l = i; l.type; l = l.via)

1537 o.push(l.type);

1538 return o.reverse();

1539 }

1540 for (let o = 0; o < s.next.length; o++) {

1541 let { type: l, next: a } = s.next[o];

1542 !l.isLeaf && !l.hasRequiredAttrs() && !(l.name in t) && (!i.type || a.validEnd) && (r.push({ match: l.contentMatch, type: l, via: i }), t[l.name] = !0);

1543 }

1544 }

1545 return null;

1546 }

1547 /**

1548 The number of outgoing edges this node has in the finite

1549 automaton that describes the content expression.

1550 */

1551 get edgeCount() {

1552 return this.next.length;

1553 }

1554 /**

1555 Get the _n_th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index-B2WzdTzI.jsView on unpkg · L1555

1556 automaton that describes the content expression.

1557 */

1558 edge(e) {

1559 if (e >= this.next.length)

1560 throw new RangeError(`There's no ${e}th edge in this content match`);

1561 return this.next[e];

1562 }

1563 /**

1564 @internal

1565 */

1566 toString() {

1567 let e = [];

1568 function t(r) {

1569 e.push(r);

1570 for (let i = 0; i < r.next.length; i++)

1571 e.indexOf(r.next[i].next) == -1 && t(r.next[i].next);

1572 }

1573 return t(this), e.map((r, i) => {

1574 let s = i + (r.validEnd ? "*" : " ") + " ";

1575 for (let o = 0; o < r.next.length; o++)

•Trigger-reachable chain: manifest.exports -> dist/editor/index.js -> dist/index-B2WzdTzI.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-B2WzdTzI.jsView on unpkg