registry / pdf-oxide-wasm / 0.3.70

pdf-oxide-wasm@0.3.70

Fast, zero-dependency PDF toolkit for Node.js, browsers, and edge runtimes — text extraction, markdown/HTML conversion, search, form filling, creation, and editing. Rust core compiled to WebAssembly.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 821 KB of source

Source & flagged code

8 flagged

nodejs/pdf_oxide.jsView file

Lines 611-651javascript

611 static load(data) {

612 try {

613 const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);

614 const ptr0 = passArray8ToWasm0(data, wasm.__wbindgen_export);

615 const len0 = WASM_VECTOR_LEN;

616 wasm.wasmcertificate_load(retptr, ptr0, len0);

617 var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);

618 var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);

619 var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);

620 if (r2) {

621 throw takeObject(r1);

622 }

623 return WasmCertificate.__wrap(r0);

624 } finally {

625 wasm.__wbindgen_add_to_stack_pointer(16);

626 }

627 }

628 /**

629 * Load a signer certificate + private key from PEM strings.

630 * `certPem` must begin `-----BEGIN CERTIFICATE-----`.

631 * `keyPem` must begin `-----BEGIN PRIVATE KEY-----` or `-----BEGIN RSA PRIVATE KEY-----`.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

nodejs/pdf_oxide.jsView on unpkg · L631

Critical

Secret Pattern

RSA private key in nodejs/pdf_oxide.js

nodejs/pdf_oxide.jsView on unpkg · L631

632 * @param {string} cert_pem

633 * @param {string} key_pem

634 * @returns {WasmCertificate}

635 */

636 static loadPem(cert_pem, key_pem) {

637 try {

638 const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);

639 const ptr0 = passStringToWasm0(cert_pem, wasm.__wbindgen_export, wasm.__wbindgen_export2);

640 const len0 = WASM_VECTOR_LEN;

641 const ptr1 = passStringToWasm0(key_pem, wasm.__wbindgen_export, wasm.__wbindgen_export2);

642 const len1 = WASM_VECTOR_LEN;

643 wasm.wasmcertificate_loadPem(retptr, ptr0, len0, ptr1, len1);

644 var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);

645 var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);

646 var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);

647 if (r2) {

648 throw takeObject(r1);

649 }

650 return WasmCertificate.__wrap(r0);

651 } finally {

nodejs/pdf_oxide_bg.wasmView file

•path = nodejs/pdf_oxide_bg.wasm kind = wasm_module sizeBytes = 17263049 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

nodejs/pdf_oxide_bg.wasmView on unpkg

nodejs/pdf_oxide.d.tsView file

Lines 239-279typescript

239 withStyle(style: ArtifactStyle): WasmArtifact;

240}

241

242/**

243 * X.509 certificate parsed from a raw DER blob. Mirrors the C#,

244 * Node, Python, and Go `Certificate` surfaces — `subject` / `issuer`

245 * / `serial` / `validity` / `isValid` getters only.

246 */

247export class WasmCertificate {

248 private

web/pdf_oxide.jsView file

Lines 603-643javascript

603 static load(data) {

604 try {

605 const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);

606 const ptr0 = passArray8ToWasm0(data, wasm.__wbindgen_export);

607 const len0

web/pdf_oxide.d.tsView file

Lines 239-279typescript

239 withStyle(style: ArtifactStyle): WasmArtifact;

240}

241

242/**

243 * X.509 certificate parsed from a raw DER blob. Mirrors the C#,

244 * Node, Python, and Go `Certificate` surfaces — `subject` / `issuer`

245 * / `serial` / `validity` / `isValid` getters only.

246 */

247export class WasmCertificate {

248 private

bundler/pdf_oxide_bg.jsView file

Lines 601-641javascript

601 static load(data) {

602 try {

603 const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);

604 const ptr0 = passArray8ToWasm0(data, wasm.__wbindgen_export);

605 const len0

bundler/pdf_oxide.d.tsView file

Lines 239-279typescript

239 withStyle(style: ArtifactStyle): WasmArtifact;

240}

241

242/**

243 * X.509 certificate parsed from a raw DER blob. Mirrors the C#,

244 * Node, Python, and Go `Certificate` surfaces — `subject` / `issuer`

245 * / `serial` / `validity` / `isValid` getters only.

246 */

247export class WasmCertificate {

248 private

Source & flagged code

8 flagged · loading source

nodejs/pdf_oxide.jsView file

631patternName = private_key_rsa severity = critical line = 631 matchedText = * `keyPe...--`.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

nodejs/pdf_oxide.jsView on unpkg · L631

631patternName = private_key_rsa severity = critical line = 631 matchedText = * `keyPe...--`.

Critical

Secret Pattern

RSA private key in nodejs/pdf_oxide.js

nodejs/pdf_oxide.jsView on unpkg · L631

nodejs/pdf_oxide_bg.wasmView file

•path = nodejs/pdf_oxide_bg.wasm kind = wasm_module sizeBytes = 17263049 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

nodejs/pdf_oxide_bg.wasmView on unpkg

nodejs/pdf_oxide.d.tsView file

259patternName = private_key_rsa severity = critical line = 259 matchedText = * `keyPe...--`.

Critical

Secret Pattern

RSA private key in nodejs/pdf_oxide.d.ts

nodejs/pdf_oxide.d.tsView on unpkg · L259

web/pdf_oxide.jsView file

623patternName = private_key_rsa severity = critical line = 623 matchedText = * `keyPe...--`.

Critical

Secret Pattern

RSA private key in web/pdf_oxide.js

web/pdf_oxide.jsView on unpkg · L623

web/pdf_oxide.d.tsView file

259patternName = private_key_rsa severity = critical line = 259 matchedText = * `keyPe...--`.

Critical

Secret Pattern

RSA private key in web/pdf_oxide.d.ts

web/pdf_oxide.d.tsView on unpkg · L259

bundler/pdf_oxide_bg.jsView file

621patternName = private_key_rsa severity = critical line = 621 matchedText = * `keyPe...--`.

Critical

Secret Pattern

RSA private key in bundler/pdf_oxide_bg.js

bundler/pdf_oxide_bg.jsView on unpkg · L621

bundler/pdf_oxide.d.tsView file

259patternName = private_key_rsa severity = critical line = 259 matchedText = * `keyPe...--`.

Critical

Secret Pattern

RSA private key in bundler/pdf_oxide.d.ts

bundler/pdf_oxide.d.tsView on unpkg · L259

Findings

7 Critical2 Medium1 Low

CriticalCritical Secretnodejs/pdf_oxide.js

CriticalSecret Patternnodejs/pdf_oxide.js

CriticalSecret Patternnodejs/pdf_oxide.d.ts

CriticalSecret Patternweb/pdf_oxide.js

CriticalSecret Patternweb/pdf_oxide.d.ts

CriticalSecret Patternbundler/pdf_oxide_bg.js

CriticalSecret Patternbundler/pdf_oxide.d.ts

MediumNetwork

MediumShips Wasm Modulenodejs/pdf_oxide_bg.wasm

LowFilesystem

Source & flagged code

8 flagged

nodejs/pdf_oxide.jsView file

Lines 611-651javascript

611 static load(data) {

612 try {

613 const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);

614 const ptr0 = passArray8ToWasm0(data, wasm.__wbindgen_export);

615 const len0 = WASM_VECTOR_LEN;

616 wasm.wasmcertificate_load(retptr, ptr0, len0);

617 var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);

618 var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);

619 var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);

620 if (r2) {

621 throw takeObject(r1);

622 }

623 return WasmCertificate.__wrap(r0);

624 } finally {

625 wasm.__wbindgen_add_to_stack_pointer(16);

626 }

627 }

628 /**

629 * Load a signer certificate + private key from PEM strings.

630 * `certPem` must begin `-----BEGIN CERTIFICATE-----`.

631 * `keyPem` must begin `-----BEGIN PRIVATE KEY-----` or `-----BEGIN RSA PRIVATE KEY-----`.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

nodejs/pdf_oxide.jsView on unpkg · L631

Critical

Secret Pattern

RSA private key in nodejs/pdf_oxide.js

nodejs/pdf_oxide.jsView on unpkg · L631

632 * @param {string} cert_pem

633 * @param {string} key_pem

634 * @returns {WasmCertificate}

635 */

636 static loadPem(cert_pem, key_pem) {

637 try {

638 const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);

639 const ptr0 = passStringToWasm0(cert_pem, wasm.__wbindgen_export, wasm.__wbindgen_export2);

640 const len0 = WASM_VECTOR_LEN;

641 const ptr1 = passStringToWasm0(key_pem, wasm.__wbindgen_export, wasm.__wbindgen_export2);

642 const len1 = WASM_VECTOR_LEN;

643 wasm.wasmcertificate_loadPem(retptr, ptr0, len0, ptr1, len1);

644 var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);

645 var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);

646 var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);

647 if (r2) {

648 throw takeObject(r1);

649 }

650 return WasmCertificate.__wrap(r0);

651 } finally {

nodejs/pdf_oxide_bg.wasmView file

•path = nodejs/pdf_oxide_bg.wasm kind = wasm_module sizeBytes = 17263049 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

nodejs/pdf_oxide_bg.wasmView on unpkg

nodejs/pdf_oxide.d.tsView file

Lines 239-279typescript

239 withStyle(style: ArtifactStyle): WasmArtifact;

240}

241

242/**

243 * X.509 certificate parsed from a raw DER blob. Mirrors the C#,

244 * Node, Python, and Go `Certificate` surfaces — `subject` / `issuer`

245 * / `serial` / `validity` / `isValid` getters only.

246 */

247export class WasmCertificate {

248 private

web/pdf_oxide.jsView file

Lines 603-643javascript

603 static load(data) {

604 try {

605 const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);

606 const ptr0 = passArray8ToWasm0(data, wasm.__wbindgen_export);

607 const len0

web/pdf_oxide.d.tsView file

Lines 239-279typescript

239 withStyle(style: ArtifactStyle): WasmArtifact;

240}

241

242/**

243 * X.509 certificate parsed from a raw DER blob. Mirrors the C#,

244 * Node, Python, and Go `Certificate` surfaces — `subject` / `issuer`

245 * / `serial` / `validity` / `isValid` getters only.

246 */

247export class WasmCertificate {

248 private

bundler/pdf_oxide_bg.jsView file

Lines 601-641javascript

601 static load(data) {

602 try {

603 const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);

604 const ptr0 = passArray8ToWasm0(data, wasm.__wbindgen_export);

605 const len0

bundler/pdf_oxide.d.tsView file

Lines 239-279typescript

239 withStyle(style: ArtifactStyle): WasmArtifact;

240}

241

242/**

243 * X.509 certificate parsed from a raw DER blob. Mirrors the C#,

244 * Node, Python, and Go `Certificate` surfaces — `subject` / `issuer`

245 * / `serial` / `validity` / `isValid` getters only.

246 */

247export class WasmCertificate {

248 private