registry / openmed / 1.9.0

openmed@1.9.0

On-device medical AI and de-identification for browsers and Node.js.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequire

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 91.2 KB of source

Source & flagged code

4 flagged

src/decoder.tsView file

Lines 121-161typescript

121 jobdepartment: "JOB_DEPARTMENT",

122 jobtitle: "JOB_TITLE",

123 lastname: "LAST_NAME",

124 licenseplate: "VEHICLE_REGISTRATION",

125 litecoinaddress: "LITECOIN_ADDRESS",

126 location: "LOCATION",

127 macaddress: "MAC_ADDRESS",

128 maskednumber: "MASKED_NUMBER",

129 medicalrecordnumber: "ID_NUM",

130 middlename: "MIDDLE_NAME",

131 mrn: "ID_NUM",

132 name: "PERSON",

133 nationalid: "ID_NUM",

134 nhs: "ID_NUM",

135 nhsnumber: "ID_NUM",

136 nie: "ID_NUM",

137 npi: "ID_NUM",

138 occupation: "OCCUPATION",

139 ordinaldirection: "ORDINAL_DIRECTION",

140 organization: "ORGANIZATION",

141 password: "PASSWORD",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/decoder.tsView on unpkg · L141

142 patient: "PERSON",

143 person: "PERSON",

144 personalurl: "URL",

145 phone: "PHONE",

146 phonenumber: "PHONE",

147 pin: "PIN",

148 place: "LOCATION",

149 postalcode: "ZIPCODE",

150 postcode: "ZIPCODE",

151 prefix: "PREFIX",

152 profession: "OCCUPATION",

153 region: "LOCATION",

154 secondaryaddress: "STREET_ADDRESS",

155 sex: "GENDER",

156 socialsecuritynumber: "SSN",

157 ssn: "SSN",

158 state: "LOCATION",

159 steuerid: "ID_NUM",

160 street: "STREET_ADDRESS",

161 streetaddress: "STREET_ADDRESS",

dist/index.jsView file

Lines 179-219javascript

179 jobdepartment: "JOB_DEPARTMENT",

180 jobtitle: "JOB_TITLE",

181 lastname: "LAST_NAME",

182 licenseplate: "VEHICLE_REGISTRATION",

183 litecoinaddress: "LITECOIN_ADDRESS",

184 location: "LOCATION",

dist/index.cjsView file

Lines 239-279javascript

239 jobdepartment: "JOB_DEPARTMENT",

240 jobtitle: "JOB_TITLE",

241 lastname: "LAST_NAME",

242 licenseplate: "VEHICLE_REGISTRATION",

243 litecoinaddress: "LITECOIN_ADDRESS",

244 location: "LOCATION",

Source & flagged code

4 flagged · loading source

src/decoder.tsView file

141patternName = generic_password severity = medium line = 141 matchedText = password...RD",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/decoder.tsView on unpkg · L141

dist/index.jsView file

533try { L534: return await import(moduleName); L535: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L533

199patternName = generic_password severity = medium line = 199 matchedText = password...RD",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L199

dist/index.cjsView file

259patternName = generic_password severity = medium line = 259 matchedText = password...RD",

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L259

Findings

4 Medium1 Low

MediumSecret Patternsrc/decoder.ts

MediumDynamic Requiredist/index.js

MediumSecret Patterndist/index.js

MediumSecret Patterndist/index.cjs

LowScripts Present

Source & flagged code

4 flagged

src/decoder.tsView file

Lines 121-161typescript

121 jobdepartment: "JOB_DEPARTMENT",

122 jobtitle: "JOB_TITLE",

123 lastname: "LAST_NAME",

124 licenseplate: "VEHICLE_REGISTRATION",

125 litecoinaddress: "LITECOIN_ADDRESS",

126 location: "LOCATION",

127 macaddress: "MAC_ADDRESS",

128 maskednumber: "MASKED_NUMBER",

129 medicalrecordnumber: "ID_NUM",

130 middlename: "MIDDLE_NAME",

131 mrn: "ID_NUM",

132 name: "PERSON",

133 nationalid: "ID_NUM",

134 nhs: "ID_NUM",

135 nhsnumber: "ID_NUM",

136 nie: "ID_NUM",

137 npi: "ID_NUM",

138 occupation: "OCCUPATION",

139 ordinaldirection: "ORDINAL_DIRECTION",

140 organization: "ORGANIZATION",

141 password: "PASSWORD",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/decoder.tsView on unpkg · L141

142 patient: "PERSON",

143 person: "PERSON",

144 personalurl: "URL",

145 phone: "PHONE",

146 phonenumber: "PHONE",

147 pin: "PIN",

148 place: "LOCATION",

149 postalcode: "ZIPCODE",

150 postcode: "ZIPCODE",

151 prefix: "PREFIX",

152 profession: "OCCUPATION",

153 region: "LOCATION",

154 secondaryaddress: "STREET_ADDRESS",

155 sex: "GENDER",

156 socialsecuritynumber: "SSN",

157 ssn: "SSN",

158 state: "LOCATION",

159 steuerid: "ID_NUM",

160 street: "STREET_ADDRESS",

161 streetaddress: "STREET_ADDRESS",

dist/index.jsView file

Lines 179-219javascript

179 jobdepartment: "JOB_DEPARTMENT",

180 jobtitle: "JOB_TITLE",

181 lastname: "LAST_NAME",

182 licenseplate: "VEHICLE_REGISTRATION",

183 litecoinaddress: "LITECOIN_ADDRESS",

184 location: "LOCATION",

dist/index.cjsView file

Lines 239-279javascript

239 jobdepartment: "JOB_DEPARTMENT",

240 jobtitle: "JOB_TITLE",

241 lastname: "LAST_NAME",

242 licenseplate: "VEHICLE_REGISTRATION",

243 litecoinaddress: "LITECOIN_ADDRESS",

244 location: "LOCATION",

Lines 513-553javascript

513 }

514 }

515}

516function isLocalModelReference(model) {

517 if (model.startsWith("file://")) {

518 return true;

519 }

520 if (model.startsWith("/") || model.startsWith("./") || model.startsWith("../") || model.startsWith("~")) {

521 return true;

522 }

523 return /^[A-Za-z]:[\\/]/.test(model);

524}

525async function resolveRuntime(runtime) {

526 if (typeof runtime === "function") {

527 return runtime();

528 }

529 if (runtime) {

530 return runtime;

531 }

532 const moduleName = TRANSFORMERS_JS_MODULE;

533 try {

534 return await import(moduleName);

535 } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L533

536 throw new Error(

537 "Install @huggingface/transformers or pass a token-classification pipeline.",

538 { cause: error }

539 );

540 }

541}

542

543// src/runtime/capability.ts

544var MAX_WASM_THREADS = 4;

545var MIN_THREADED_WASM_CONCURRENCY = 2;

546var WASM_SIMD_PROBE = new Uint8Array([

547 0,

548 97,

549 115,

550 109,

551 1,

552 0,

553 0,