registry / pptx-glimpse / 3.0.0

pptx-glimpse@3.0.0

⚠ Under review

A lightweight JavaScript library for rendering PowerPoint (.pptx) files as SVG or PNG in Node.js. No LibreOffice required.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 1.38 MB of source, external domains: prosemirror.net, purl.oclc.org, schemas.microsoft.com, schemas.openxmlformats.org, www.w3.org

Source & flagged code

2 flagged

dist/browser.cjsView file

Lines 12816-12856javascript

12816 return result.reverse();

12817 }

12818 for (let i = 0; i < match.next.length; i++) {

12819 let { type, next } = match.next[i];

12820 if (!type.isLeaf && !type.hasRequiredAttrs() && !(type.name in seen) && (!current.type || next.validEnd)) {

12821 active.push({ match: type.contentMatch, type, via: current });

12822 seen[type.name] = true;

12823 }

12824 }

12825 }

12826 return null;

12827 }

12828 /**

12829 The number of outgoing edges this node has in the finite

12830 automaton that describes the content expression.

12831 */

12832 get edgeCount() {

12833 return this.next.length;

12834 }

12835 /**

12836 Get the _n_th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/browser.cjsView on unpkg · L12836

12837 automaton that describes the content expression.

12838 */

12839 edge(n) {

12840 if (n >= this.next.length)

12841 throw new RangeError(`There's no ${n}th edge in this content match`);

12842 return this.next[n];

12843 }

12844 /**

12845 @internal

12846 */

12847 toString() {

12848 let seen = [];

12849 function scan(m) {

12850 seen.push(m);

12851 for (let i = 0; i < m.next.length; i++)

12852 if (seen.indexOf(m.next[i].next) == -1)

12853 scan(m.next[i].next);

12854 }

12855 scan(this);

12856 return seen.map((m, i) => {

dist/browser.jsView file

•Trigger-reachable chain: manifest.exports -> dist/browser.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/browser.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/browser.cjsView file

12836contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/browser.cjsView on unpkg · L12836

dist/browser.jsView file

•Trigger-reachable chain: manifest.exports -> dist/browser.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/browser.jsView on unpkg

Findings

2 Critical1 Medium4 Low

CriticalTrojan Source Unicodedist/browser.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/browser.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/browser.cjsView file

Lines 12816-12856javascript

12816 return result.reverse();

12817 }

12818 for (let i = 0; i < match.next.length; i++) {

12819 let { type, next } = match.next[i];

12820 if (!type.isLeaf && !type.hasRequiredAttrs() && !(type.name in seen) && (!current.type || next.validEnd)) {

12821 active.push({ match: type.contentMatch, type, via: current });

12822 seen[type.name] = true;

12823 }

12824 }

12825 }

12826 return null;

12827 }

12828 /**

12829 The number of outgoing edges this node has in the finite

12830 automaton that describes the content expression.

12831 */

12832 get edgeCount() {

12833 return this.next.length;

12834 }

12835 /**

12836 Get the _n_th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/browser.cjsView on unpkg · L12836

12837 automaton that describes the content expression.

12838 */

12839 edge(n) {

12840 if (n >= this.next.length)

12841 throw new RangeError(`There's no ${n}th edge in this content match`);

12842 return this.next[n];

12843 }

12844 /**

12845 @internal

12846 */

12847 toString() {

12848 let seen = [];

12849 function scan(m) {

12850 seen.push(m);

12851 for (let i = 0; i < m.next.length; i++)

12852 if (seen.indexOf(m.next[i].next) == -1)

12853 scan(m.next[i].next);

12854 }

12855 scan(this);

12856 return seen.map((m, i) => {

dist/browser.jsView file

•Trigger-reachable chain: manifest.exports -> dist/browser.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/browser.jsView on unpkg