registry / shadcn-svelte / 1.4.0

shadcn-svelte@1.4.0

Add components to your apps.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 770 KB of source, external domains: foo.com, github.com, json-schema.org, shadcn-svelte.com, tw3.shadcn-svelte.com

Source & flagged code

4 flagged

dist/index.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{n as e,r as t,t as n}from"./chunk-BMbogX1O.mjs";import{S as r,d as i,f as a,g as o,i as s,l as c,n as l,o as u,r as d,s as f,t as p,x as m,y as h}from"./libraries-tdyxKhrQ.mjs";import{i as g,n as _,r as v,t as y}from"./transform-icons-BeDxN90c.mjs";import{a as b,i as x,n as S,r as C,t as w}from"./constants-D_Gv5Vlp.mjs";import{a as ee,d as te,l as ne,m as re,n as ie,p as T,t as ae,u as oe,y as se}from"./preset-DZGU31yg.mjs";import{a as ce,d as le,f as E,g as ue,h as de,l as fe,m as pe,p as me,u as he}from"./schema-D5x96-U7.mjs";import{n as ge}from"./css-DrLymJRV.mjs";import{t as _e}from ...

3`;break;case 114:t+=`\r`;break;case 116:t+=` `;break;case 117:let e=f(4);e>=0?t+=String.fromCharCode(e):d=4;break;default:d=5}i=r;continue}if(a>=0&&a<=31)if(Pt(a)){t+=e.substring(i,r),d=2;break}else d=6;r++}return t}F(h,`scanString`);function g(){if(i=``,d=0,a=r,c=s,u=l,r>=n)return a=n,o=17;let t=e.charCodeAt(r);if(Nt(t)){do r++,i+=String.fromCharCode(t),t=e.charCodeAt(r);while(Nt(t));return o=15}if(Pt(t))return r++,i+=String.fromCharCode(t),t===13&&e.charCodeAt(r)===10&&(r++,i+=`

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L1

4`),s++,l=r,o=14;switch(t){case 123:return r++,o=1;case 125:return r++,o=2;case 91:return r++,o=3;case 93:return r++,o=4;case 58:return r++,o=6;case 44:return r++,o=5;case 34:return r++,i=h(),o=10;case 47:let c=r-1;if(e.charCodeAt(r+1)===47){for(r+=2;r<n&&!Pt(e.charCodeAt(r));)r++;return i=e.substring(c,r),o=12}if(e.charCodeAt(r+1)===42){r+=2;let t=n-1,a=!1;for(;r<t;){let t=e.charCodeAt(r);if(t===42&&e.charCodeAt(r+1)===47){r+=2,a=!0;break}r++,Pt(t)&&(t===13&&e.charCodeAt(r)===10&&r++,s++,l=r)}return a||(r++,d=1),i=e.substring(c,r),o=13}return i+=String.fromCharCode(t),r++,o=16;case 45:if(i+=St ...

5`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r

6`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`

7`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r

8`+` `.repeat(t));var Lt;(function(e){e.DEFAULT={allowTrailingComma:!1}})(Lt||={});function Rt(e,t=[],n=Lt.DEFAULT){let r=null,i=[],a=[];function o(e){Array.isArray(i)?

9`),u=l[Symbol.iterator](),d=u.next(),f=u.next(),p=0;for(;!d.done;){let e=d.value,t=f.value;if(r+=e,e===`\x1B`||e===``){gi.lastIndex=p+1;let e=gi.exec(l)?.groups;if(e?.code!==void 0){let t=Number.parseFloat(e.code);i=t===39?void 0:t}else e?.uri!==void 0&&(a=e.uri.length===0?void 0:e.uri)}let n=i?_i(i):void 0;t===`

10`?(a&&(r+=yi(``)),i&&n&&(r+=vi(n))):e===`

11`&&(i&&n&&(r+=vi(i)),a&&(r+=yi(a))),p+=e.length,d=f,f=u.next()}return r};function wi(e,t,n){return String(e).normalize().replaceAll(`\r

12`,`

13`).split(`

14`).map(e=>Ci(e,t,n)).join(`

15`)}const V={actions:new Set([`up`,`down`,`left`,`right`,`space`,`enter`,`cancel`]),aliases:new Map([[`k`,`up`],[`j`,`down`],[`h`,`left`],[`l`,`right`],[``,`cancel`],[`escape`,`cancel`]]),messages:{cancel:`Canceled`,error:`Something went wrong`},withGuide:!0};function Ti(e,t){if(typeof e==`string`)return V.aliases.get(e)===t;for(let n of e)if(n!==void 0&&Ti(n,t))return!0;return!1}function Ei(e,t){if(e===t)return;let n=e.split(`

16`),r=t.split(`

17`),i=Math.max(n.length,r.length),a=[];for(let e=0;e<i;e++)n[e]!==r[e]&&a.push(e);return{lines:a,numLinesBefore:n.length,numLinesAfter:r.length,numLines:i}}const Di=globalThis.process.platform.startsWith(`win`),Oi=Symbol(`clack:cancel`);function H(e){return e===Oi}function ki(e,t){let n=e;n.isTTY&&n.setRawMode(t)}function Ai({input:e=De,output:t=Oe,overwrite:n=!0,hideCursor:r=!0}={}){let i=Qe.createInterface({input:e,output:t,prompt:``,tabSize:1});Qe.emitKeypressEvents(e,i),e instanceof et&&e.isTTY&&e.setRawMode(!0);let a=(i,{name:o,sequence:s})=>{if(Ti([String(i),o,s],`cancel`)){r&&t.write(B.c ...

18`).map((e,t)=>`${t===0?r:n}${e}`).join(`

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L1

19`)}var Pi=class{input;output;_abortSignal;rl;opts;_render;_track=!1;_prevFrame=``;_subscribers=new Map;_cursor=0;state=`initial`;error=``;value;userInput=``;constructor(e,

20`),ki(this.input,!1),this.rl?.close(),this.rl=void 0,this.emit(`${this.state}`,this.value),this.unsubscribe()}restoreCursor(){let e=wi(this._prevFrame,process.stdout.columns,{hard:!0,trim:!1}).split(`

21`).length-1;this.output.write(B.cursor.move(-999,e*-1))}render(){let e=wi(this._render(this)??``,process.stdout.columns,{hard:!0,trim:!1});if(e!==this._prevFrame){if(this.state===`initial`)this.output.write

Long lines were clipped for display.

dist/transform-strip-types-A1LmF7Cf.mjsView file

Lines 114-138javascript

114 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

115 return result == null ? true : result;

116 }

117 `};e.HelperManager=class e{__init(){this.helperNames={}}__init2(){this.createRequireName=null}constructor(t){this.nameManager=t,e.prototype.__init.call(this),e.prototype.__init2.call(this)}getHelperName(e){let t=this.helperNames[e];return t||(t=this.nameManager.claimFreeName(`_${e}`),this.helperNames[e]=t,t)}emitHelpers(){let e=``;this.helperNames.optionalChainDelete&&this.getHelperName(`

dist/transform-icons-BeDxN90c.mjsView file

Lines 1-2javascript

1import{t as e}from"./libraries-tdyxKhrQ.mjs";import{t}from"./src-D1e-SXHI.mjs";import{t as n}from"./magic-string.es-Ze7NMroB.mjs";import{parse as r}from"svelte/compiler";function i(e,t){return new a(e,{cause:t})}

Source & flagged code

4 flagged · loading source

dist/index.mjsView file

1#!/usr/bin/env node L2: import{n as e,r as t,t as n}from"./chunk-BMbogX1O.mjs";import{S as r,d as i,f as a,g as o,i as s,l as c,n as l,o as u,r as d,s as f,t as p,x as m,y as h}from"./libraries-tdyxKhrQ.m... L3: `;break;case 114:t+=`\r`;break;case 116:t+=` `;break;case 117:let e=f(4);e>=0?t+=String.fromCharCode(e):d=4;break;default:d=5}i=r;continue}if(a>=0&&a<=31)if(Pt(a)){t+=e.substring(i...

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L1

1Cross-file remote execution chain: dist/index.mjs spawns dist/magic-string.es-Ze7NMroB.mjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import{n as e,r as t,t as n}from"./chunk-BMbogX1O.mjs";import{S as r,d as i,f as a,g as o,i as s,l as c,n as l,o as u,r as d,s as f,t as p,x as m,y as h}from"./libraries-tdyxKhrQ.m... L3: `;break;case 114:t+=`\r`;break;case 116:t+=` `;break;case 117:let e=f(4);e>=0?t+=String.fromCharCode(e):d=4;break;default:d=5}i=r;continue}if(a>=0&&a<=31)if(Pt(a)){t+=e.substring(i... ... L7: `+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r L8: `+` `.repeat(t));var Lt;(function(e){e.DEFAULT={allowTrailingComma:!1}})(Lt||={});function Rt(e,t=[],n=Lt.DEFAULT){let r=null,i=[],a=[];function o(e){Array.isArray(i)?i.push(e):r!=... L9: `),u=l[Symbol.iterator](),d=u.next(),f=u.next(),p=0;for(;!d.done;){let e=d.value,t=f.value;if(r+=e,e===`\x1B`||e===``){gi.lastIndex=p+1;let e=gi.exec(l)?.groups;if(e?.code!==void ... ... L16: `),r=t.split(` L17: `),i=Math.max(n.length,r.length),a=[];for(let e=0;e<i;e++)n[e]!==r[e]&&a.push(e);return{lines:a,numLinesBefore:n.length,numLinesAfter…

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L1

dist/transform-strip-types-A1LmF7Cf.mjsView file

134`);return i===-1&&(i=r.length,r+=` L135: `),{code:r.slice(0,i+1)+e+r.slice(i+1)+t,mappings:this.shiftMappings(n.mappings,e.length)}}else return{code:e+r+t,mappings:this.shiftMappings(n.mappings,e.length)}}processBalancedC... L136: `,n=`\r`,r=function(){function e(e){this.string=e;for(var r=[0],i=0;i<e.length;)switch(e[i]){case t:i+=t.length,r.push(i);break;case n:i+=n.length,e[i]===t&&(i+=t.length),r.push(i)...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/transform-strip-types-A1LmF7Cf.mjsView on unpkg · L134

dist/transform-icons-BeDxN90c.mjsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/transform-icons-BeDxN90c.mjsView on unpkg · L1

Findings

2 High3 Medium6 Low

HighChild Processdist/index.mjs

HighCross File Remote Execution Contextdist/index.mjs

MediumDynamic Requiredist/transform-icons-BeDxN90c.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/transform-strip-types-A1LmF7Cf.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L1

5`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r

6`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`

7`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r`+` `.repeat(t)),Array(200).fill(0).map((e,t)=>`\r

8`+` `.repeat(t));var Lt;(function(e){e.DEFAULT={allowTrailingComma:!1}})(Lt||={});function Rt(e,t=[],n=Lt.DEFAULT){let r=null,i=[],a=[];function o(e){Array.isArray(i)?

10`?(a&&(r+=yi(``)),i&&n&&(r+=vi(n))):e===`

11`&&(i&&n&&(r+=vi(i)),a&&(r+=yi(a))),p+=e.length,d=f,f=u.next()}return r};function wi(e,t,n){return String(e).normalize().replaceAll(`\r

12`,`

13`).split(`

14`).map(e=>Ci(e,t,n)).join(`

16`),r=t.split(`

18`).map((e,t)=>`${t===0?r:n}${e}`).join(`

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L1

19`)}var Pi=class{input;output;_abortSignal;rl;opts;_render;_track=!1;_prevFrame=``;_subscribers=new Map;_cursor=0;state=`initial`;error=``;value;userInput=``;constructor(e,

Long lines were clipped for display.

dist/transform-strip-types-A1LmF7Cf.mjsView file

Lines 114-138javascript

114 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

115 return result == null ? true : result;

116 }

dist/transform-icons-BeDxN90c.mjsView file

Lines 1-2javascript