prismic@1.15.0
Prismic's official command line tool
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•name = prismic; similarTo = prisma
Medium
Typosquat Name
Package name is suspiciously similar to a popular package name.
package.jsonView on unpkgdist/builders-hKD4IrLX-BtLj8fPt.mjsView file
1import{Q as e,Z as t}from"./core-C2WfsoNg.mjs";import{promises as n}from"node:fs";var r=e(t((e=>{Object.defineProperty(e,`__esModule`,{value:!0});function t(e,t){if(e==null)return{...
L2: `:`\r
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/builders-hKD4IrLX-BtLj8fPt.mjsView on unpkg · L1dist/core-C2WfsoNg.mjsView file
7`))&&!t?.force?e:xt(e)+`
L8: `}function X(e,t){return St(t)+e}const Ct=`https://prismic.io/docs/slices`,wt={UID:`https://prismic.io/docs/fields/uid`,Boolean:`https://prismic.io/docs/fields/boolean`,Color:`http...
L9: /**
...
L166: }
L167: `,r)}return r}var jn=L(import.meta.url);function Mn(e){let t=j(e);return t.length>1&&t[t.length-1]===F&&(t=t.substring(0,t.length-1)),t}const Nn=/[\\/]/g;function Pn(e,t){return e....
L168: `),l=null;for(let e of c){let t=e.match(/^(\s+)\S+/);if(t){let e=t[1].length;l=l?Math.min(l,e):e}}if(l!==null){let e=l;s=c.map(t=>t[0]===` `||t[0]===` `?t.slice(e):t).join(`
Findings
2 High6 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/auth-BQ-T06tR.mjs
HighPrevious Version Dangerous Deltadist/auth-BQ-T06tR.mjs
MediumTyposquat Namepackage.json
MediumDynamic Requiredist/builders-hKD4IrLX-BtLj8fPt.mjs
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/core-C2WfsoNg.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to prismic@1.15.0.
See all versions of prismic for other recorded verdicts.
- Review the evidence and your use of prismic@1.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.