registry / render-tag / 0.1.26

render-tag@0.1.26

⚠ Under review

Render HTML rich text onto canvas using pure 2D API

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chain

HighEntropyStringsMinified

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 321 KB of source

Source & flagged code

2 flagged

lib/render-tag.umd.jsView file

Lines 1-12javascript

1(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports):typeof define==`function`&&define.amd?define([`exports`],t)

Source & flagged code

2 flagged · loading source

lib/render-tag.umd.jsView file

9contains invisible/control Unicode U+200D (zero width joiner) `,width:0,style:r.style,isSpace:!1,boxStyle:r.boxStyle}),a[t]){let o=n.length;ye(e,a[t],r,n),i(o)}}else{let a=n.length;ye(e,t,r,n),i(a)}}return n}function Z(e){let t=e.codePointAt(0)||0;return t>=19968&&t<=40959||t>=13312&&t<=19903||t>=1228

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/render-tag.umd.jsView on unpkg · L9

•Trigger-reachable chain: manifest.exports -> lib/render-tag.umd.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/render-tag.umd.jsView on unpkg

Findings

2 Critical1 Medium2 Low

CriticalTrojan Source Unicodelib/render-tag.umd.js

CriticalTrigger Reachable Dangerous Capabilitylib/render-tag.umd.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

2`,e.remove();t.body.normalize();let i=t.createDocumentFragment();for(;t.body.firstChild;)i.appendChild(t.body.firstChild);return{fragment:i,css:r}}var s=1,c=3;function l(e){let t=[],n=[];e=e.replace(/\/\*[\s\S]*?\*\//g,``);let r=0;for(;r<e.length;){for(;r<e.length&&/\s/.test(e[r]);)r++;if(r>=e.length)break;if(e[r]===`@`){let t=r,i=0;for(;r<e.length;){if(e[r]===`{`&&i++,e[r]===`}`&&(i--,i<=0)){r++;break}r++}let a=e.slice(t,r);a.startsWith(`@font-face`)&&n.push(a);continue}let i=r;for(;r<e.length&&e[r]!==`{`;)r++;if(r>=e.length)break;let a=e.slice(i,r).trim();r++;let o=r;for(;r<e.length&&e[r]!== ...

3`),document.head.appendChild(a));let o=E(r),u=e.ownerDocument.createElement(`div`);u.appendChild(e);function d(e,t){let n=new Set,r=e.getAttribute(`class`);if(r)for(let e of r.split(/\s+/))e&&n.add(e);return{tagName:e.tagName.toLowerCase(),classes:n,parent:t,el:e}}function f(e,t,r){let i=e.tagName.toLowerCase(),a=d(e,r),s=h(),c=new Set,l=[],u=new Set,f=o.byTag.get(i);if(f)for(let e of f)u.add(e),l.push(e);for(let e of a.classes){let t=o.byClass.get(e);if(t)for(let e of t)u.has(e)||(u.add(e),l.push(e))}for(let e of o.universal)u.has(e)||(u.add(e),l.push(e));let _=[],v=[];for(let e of l)if(m(e.s ...

5`}:f(r,t,n)}return{tree:f(u,h(),null),cleanup:()=>{a&&a.remove()}}}var P=!0,F,I=[],L=new Map;function R(e,t){let n=e.font+`\0`+(e.letterSpacing||``)+`\0`+t,r=L.get(n);if(r!==void 0)return r;let i=e.measureText(t).width;return L.set(n,i),i}function ee(e){let t=``;for(let n of e){if(!n.text||n.isSpace)continue;let e=V(n.style);if(t&&e!==t)return!0;t=e}return!1}function z(e,t){e.font=V(t),e.fontKerning=t.fontKerning===`none`?`none`:`normal`}function B(e){return Number.isFinite(e)&&e!==0?`${e}px`:`0px`}var te=new Map;function V(e){let t=`${e.fontStyle}|${e.fontVariantCaps}|${e.fontWeight}|${e.font ...

9`,width:0,style:r.style,isSpace:!1,boxStyle:r.boxStyle}),a[t]){let o=n.length;ye(e,a[t],r,n),i(o)}}else{let a=n.length;ye(e,t,r,n),i(a)}}return n}function Z(e){let t=e.codePointAt(0)||0;return t>=19968&&t<=40959||t>=13312&&t<=19903||t>=12288&&t<=12351||t>=12352&&t<=12447||t>=12448&&t<=12543||t>=44032&&t<=55215||t>=65280&&t<=65519||t>=131072&&t<=173791}var xe;function Se(){return xe||(typeof Intl<`u`&&Intl.Segmenter?(xe=new Intl.Segmenter(void 0,{granularity:`grapheme`}),xe):null)}var Ce=/\p{Extended_Pictographic}/u;function we(e){for(let t of e)if(t.codePointAt(0)>=126976)return!0;return e.inc ...

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/render-tag.umd.jsView on unpkg · L9

10`){u.words.length===0?(u.lineHeight=Math.max(u.lineHeight,p),u.endedByHardBreak=!0,c.push(u),u=l()):(u.endedByHardBreak=!0,h()),g=!0;continue}if(d){u.words.push(s),u.totalWidth+=s.width,u.lineHeight=Math.max(u.lineHeight,p);continue}if(!s.isSpace&&s.text&&!s.noBreakBefore&&!s.boxOpen&&!s.boxClose){let n=r;for(;n+1<t.length;){let e=t[n+1];if(!e.text||e.isSpace||e.boxOpen||e.boxClose||!e.noBreakBefore)break;n++}if(n>r){let a=s.style.overflowWrap===`break-word`||s.style.wordBreak===`break-all`,o=0;for(let e=r;e<=n;e++)o+=t[e].width;let c=[];for(let e=r;e<=n;e++)for(let n of[...t[e].text])c.push({ ...

11`)break;let r=!!n.text&&Ee.test(n.text),i=!n.text&&!!n.boxClose,a=!!n.text&&!!n.noBreakBefore;if(r||i||a){v+=n.width;continue}break}for(let i of _){let s=i===_[_.length-1]?v:0,l=!i.isSpace&&i.text.length>0&&Ee.test(i.text)&&u.words.length>0&&!u.words[u.words.length-1].isSpace,d=i===_[0]&&i.noBreakBefore&&u.words.length>0&&!u.words[u.words.length-1].isSpace,y=0;if(!i.text&&i.boxOpen){let n=t[r+1];n&&!n.isSpace&&n.text&&(y=(n.text.length>1?Te(e,n,f(),0):[n])[0].width)}let b=0;if(i.isSoftHyphenBreak&&(z(e,i.style),e.letterSpacing=B(i.style.letterSpacing),b=R(e,`-`)),!i.isSpace&&!l&&!d&&u.words.le ...