registry / pivotgrid-js / 0.1.12

pivotgrid-js@0.1.12

Vanilla JS pivot table — no dependencies, no frameworks

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinified

Manifest

NoLicense

scanned 18 file(s), 761 KB of source

Oversized source lightweight scan

demo_data/demo-data.js3.45 MB file, sampled 256 KB

Minified

Source & flagged code

4 flagged

server/.envView file

5patternName = blocked_file severity = critical matchedText = server/.env redactedSecretContext = secretLikeLines = 1 L5: DB_PASSWORD=<redacted:5 value>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/.envView on unpkg · L5

widget/pivot-widget.jsView file

Lines 221-261javascript

221

222// ── Config ────────────────────────────────────────────────────────────────────

223

224let CONFIG = {};

225

226/**

227 * Loads the widget configuration from the appropriate source:

228 * - demo mode: uses DEMO_CONFIG

229 * - preview mode: reads from localStorage

230 * - normal mode: fetches from the server by CONFIG_NAME

231 */

232async function loadConfig() {

233 if (IS_DEMO) {

234 const registry = window.DEMO_CONFIGS || {};

235 CONFIG = (DEMO_NAME !== 'true' && registry[DEMO_NAME]) || DEMO_CONFIG;

236 return;

237 }

238

239 if (IS_PREVIEW) {

240 const text = localStorage.getItem('pivot_config_preview');

241 if (text) {

242 const fn = new Function(text + '\nreturn CONFIG;');

243 CONFIG = fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

widget/pivot-widget.jsView on unpkg · L241

244 }

245 return;

246 }

247

248 if (CONFIG_NAME) {

249 const res = await fetch(`${SERVER_URL}/configs/${CONFIG_NAME}`);

250 if (!res.ok) throw new Error(`Config "${CONFIG_NAME}" not found`);

251 CONFIG = await res.json();

252 return;

253 }

254

255 throw new Error('data-config attribute is missing on the grid container');

256}

257

258// ── State ─────────────────────────────────────────────────────────────────────

259

260let provider; // RestProvider or ArrayProvider

261let aggregator; // Aggregator instance

server/connectors/postgresql.pyView file

•path = server/connectors/postgresql.py kind = build_helper sizeBytes = 925 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/connectors/postgresql.pyView on unpkg

demo_data/demo-data.jsView file

•path = demo_data/demo-data.js kind = oversized_source_file sizeBytes = 3613309 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

demo_data/demo-data.jsView on unpkg

Source & flagged code

4 flagged · loading source

server/.envView file

5patternName = blocked_file severity = critical matchedText = server/.env redactedSecretContext = secretLikeLines = 1 L5: DB_PASSWORD=<redacted:5 value>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/.envView on unpkg · L5

widget/pivot-widget.jsView file

241if (text) { L242: const fn = new Function(text + '\nreturn CONFIG;'); L243: CONFIG = fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

widget/pivot-widget.jsView on unpkg · L241

server/connectors/postgresql.pyView file

•path = server/connectors/postgresql.py kind = build_helper sizeBytes = 925 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/connectors/postgresql.pyView on unpkg

demo_data/demo-data.jsView file

•path = demo_data/demo-data.js kind = oversized_source_file sizeBytes = 3613309 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

demo_data/demo-data.jsView on unpkg

Findings

1 Critical1 High3 Medium5 Low

CriticalCritical Secretserver/.env

HighOversized Source Filedemo_data/demo-data.js

MediumNetwork

MediumShips Build Helperserver/connectors/postgresql.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalwidget/pivot-widget.js

LowHigh Entropy Strings

LowNo License

Source & flagged code

4 flagged

server/.envView file

5patternName = blocked_file severity = critical matchedText = server/.env redactedSecretContext = secretLikeLines = 1 L5: DB_PASSWORD=<redacted:5 value>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/.envView on unpkg · L5

widget/pivot-widget.jsView file

Lines 221-261javascript

221

223

224let CONFIG = {};

225

226/**

227 * Loads the widget configuration from the appropriate source:

228 * - demo mode: uses DEMO_CONFIG

229 * - preview mode: reads from localStorage

230 * - normal mode: fetches from the server by CONFIG_NAME

231 */

232async function loadConfig() {

233 if (IS_DEMO) {

234 const registry = window.DEMO_CONFIGS || {};

235 CONFIG = (DEMO_NAME !== 'true' && registry[DEMO_NAME]) || DEMO_CONFIG;

236 return;

237 }

238

239 if (IS_PREVIEW) {

240 const text = localStorage.getItem('pivot_config_preview');

241 if (text) {

242 const fn = new Function(text + '\nreturn CONFIG;');

243 CONFIG = fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

widget/pivot-widget.jsView on unpkg · L241

244 }

245 return;

246 }

247

248 if (CONFIG_NAME) {

249 const res = await fetch(`${SERVER_URL}/configs/${CONFIG_NAME}`);

250 if (!res.ok) throw new Error(`Config "${CONFIG_NAME}" not found`);

251 CONFIG = await res.json();

252 return;

253 }

254

255 throw new Error('data-config attribute is missing on the grid container');

256}

257

259

260let provider; // RestProvider or ArrayProvider

261let aggregator; // Aggregator instance

server/connectors/postgresql.pyView file

•path = server/connectors/postgresql.py kind = build_helper sizeBytes = 925 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/connectors/postgresql.pyView on unpkg

demo_data/demo-data.jsView file

•path = demo_data/demo-data.js kind = oversized_source_file sizeBytes = 3613309 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

demo_data/demo-data.jsView on unpkg