registry / polotno-node / 3.0.3

polotno-node@3.0.3

⚠ Under review

Polotno workflow from NodeJS

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 11 file(s), 2.66 MB of source, external domains: aomediacodec.github.io, api.polotno.com, cdnjs.cloudflare.com, github.com, json-schema.org, konvajs.github.io, konvajs.org, polotno.com, react.dev, www.w3.org, www.webmproject.org

Source & flagged code

2 flagged

lib/font-cache.jsView file

Lines 7-47javascript

7// cache, so without this each render re-downloads the same fonts — and bursts

8// of parallel renders (e.g. a test suite) get throttled by Google Fonts: the

9// stylesheet request just hangs, the font load times out and text falls back

10// to a default font.

11//

12// Two layers sit behind the `tryRespond` / `capture` interface:

13// 1. an in-memory Map for the lifetime of the process, and

14// 2. a disk cache shared between processes and across runs (e.g. parallel

15// test workers), so even a cold process doesn't re-download.

16const FONT_HOSTS = ["fonts.googleapis.com", "fonts.gstatic.com"];

17const isFontUrl = (url) => FONT_HOSTS.some((host) => url.includes(host));

18const memoryCache = new Map(); // url -> { contentType, body }

19const FONT_CACHE_DIR = path.join(os.tmpdir(), "polotno-node-font-cache");

20const FONT_CACHE_TTL = 7 * 24 * 60 * 60 * 1000;

21const fontCacheDiskPath = (url) => path.join(FONT_CACHE_DIR, crypto.createHash("sha1").update(url).digest("hex") + ".json");

22const readFontCacheFromDisk = (url) => {

23 try {

24 const file = fontCacheDiskPath(url);

25 if (Date.now() - fs.statSync(file).mtimeMs > FONT_CACHE_TTL) {

26 return null;

27 }

28 const data = JSON.parse(fs.readFileSync(file, "utf8"));

29 return {

30 contentType: data.contentType,

31 body: Buffer.from(data.body, "base64"),

32 };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/font-cache.jsView on unpkg · L27

33 }

34 catch (e) {

35 return null;

36 }

37};

38const writeFontCacheToDisk = (url, entry) => {

39 try {

40 fs.mkdirSync(FONT_CACHE_DIR, { recursive: true });

41 const file = fontCacheDiskPath(url);

42 const tmpFile = `${file}.${process.pid}.tmp`;

43 fs.writeFileSync(tmpFile, JSON.stringify({

44 url,

45 contentType: entry.contentType,

46 body: entry.body.toString("base64"),

47 }));

dist/assets/jspdf.es.min-CAO1hjjP.jsView file

Lines 1-23javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./html2canvas-C8a2rCl7.js","./index-nUNsrps4.js","./index.es-Cv2hC1UF.js","./typeof-B5XbjTb1.js"])))=>i.map(i=>d[i]);

2import{kt as e,t}from"./index-nUNsrps4.js"

Source & flagged code

2 flagged · loading source

lib/font-cache.jsView file

27} L28: const data = JSON.parse(fs.readFileSync(file, "utf8")); L29: return { L30: contentType: data.contentType, L31: body: Buffer.from(data.body, "base64"), L32: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/font-cache.jsView on unpkg · L27

dist/assets/jspdf.es.min-CAO1hjjP.jsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ne(e,t){return ee(e)||H(e,t)||W(e,t)||te()}function re(e,t=`utf8`){return new TextDecoder(t).decode(e)}var ie=new TextEncoder;function ae(e){retur

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/jspdf.es.min-CAO1hjjP.jsView on unpkg · L3

Findings

1 Critical3 Medium7 Low

CriticalTrojan Source Unicodedist/assets/jspdf.es.min-CAO1hjjP.js

MediumDynamic Require

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/font-cache.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License