registry  /  polotno-node  /  3.0.2

polotno-node@3.0.2

⚠ Under review

Polotno workflow from NodeJS

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 11 file(s), 2.66 MB of source, external domains: aomediacodec.github.io, api.polotno.com, cdnjs.cloudflare.com, github.com, json-schema.org, konvajs.github.io, konvajs.org, polotno.com, react.dev, www.w3.org, www.webmproject.org

Source & flagged code

3 flagged · loading source
dist/assets/index-DFqP22V0.jsView file
273contains invisible/control Unicode U+200B (zero width space) `&&(e.text=e.text.toUpperCase())}),r},a=(e,r)=>{for(let i of Array.from(e.children)){let e=i.tagName.toLowerCase();if(e===`ul`||e===`ol`){let o=e===`ol`,s=parseInt(i.getAttribute(`start`)||`1`,10)||1;for(let e of Array.from(i.children)){if(
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/index-DFqP22V0.jsView on unpkg · L273
110`)}var wx=0,Tx=function(){function e(){Object.defineProperty(this,"cacheId",{enumerable:!0,configurable:!0,writable:!0,value:wx++}),Object.defineProperty(this,"cache",{enumerable:!... L111: (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);var f=new Error("Cannot find module '"+... L112: `],{type:`application/javascript`}))})}var lw=()=>`https://api.polotno.com/api`,uw=Gt({imageDownScalingEnabled:!0,removeBackgroundEnabled:!1,htmlRenderEnabled:!1,renderTagTextEnabl...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/index-DFqP22V0.jsView on unpkg · L110
lib/font-cache.jsView file
27} L28: const data = JSON.parse(fs.readFileSync(file, "utf8")); L29: return { L30: contentType: data.contentType, L31: body: Buffer.from(data.body, "base64"), L32: };
Low
Weak Crypto

Package source references weak cryptographic algorithms.

lib/font-cache.jsView on unpkg · L27

Findings

1 Critical3 Medium7 Low
CriticalTrojan Source Unicodedist/assets/index-DFqP22V0.js
MediumDynamic Requiredist/assets/index-DFqP22V0.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptolib/font-cache.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License