registry  /  polotno-node  /  3.1.0

polotno-node@3.1.0

⚠ Under review

Polotno workflow from NodeJS

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 13 file(s), 2.68 MB of source, external domains: aomediacodec.github.io, api.polotno.com, cdnjs.cloudflare.com, fonts.googleapis.com, github.com, json-schema.org, konvajs.github.io, konvajs.org, polotno.com, react.dev, www.w3.org, www.webmproject.org

Source & flagged code

3 flagged · loading source
dist/assets/index-B1I_EVWv.jsView file
385contains invisible/control Unicode U+200B (zero width space) `&&(e.text=e.text.toUpperCase())}),r},r=(e,i)=>{let a=e.tagName.toLowerCase()===`ol`,o=parseInt(e.getAttribute(`start`)||`1`,10)||1;for(let s of Array.from(e.children)){if(s.tagName.toLowerCase()!==`li`)continue;let e=s.getAttribute(`value`
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/index-B1I_EVWv.jsView on unpkg · L385
112`)}}var Ux=0,Wx=function(){function e(){Object.defineProperty(this,"cacheId",{enumerable:!0,configurable:!0,writable:!0,value:Ux++}),Object.defineProperty(this,"cache",{enumerable:... L113: (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);var f=new Error("Cannot find module '"+... L114: `],{type:`application/javascript`}))})}var Ow=()=>`https://api.polotno.com/api`,kw=zt({imageDownScalingEnabled:!0,removeBackgroundEnabled:!1,htmlRenderEnabled:!1,renderTagTextEnabl...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/index-B1I_EVWv.jsView on unpkg · L112
lib/font-cache.jsView file
27} L28: const data = JSON.parse(fs.readFileSync(file, "utf8")); L29: return { L30: contentType: data.contentType, L31: body: Buffer.from(data.body, "base64"), L32: };
Low
Weak Crypto

Package source references weak cryptographic algorithms.

lib/font-cache.jsView on unpkg · L27

Findings

1 Critical3 Medium7 Low
CriticalTrojan Source Unicodedist/assets/index-B1I_EVWv.js
MediumDynamic Requiredist/assets/index-B1I_EVWv.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptolib/font-cache.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License