Loading npm security reports…
A Figma plugin for D2C
No concrete attack was identified. Inspected entrypoints implement design conversion, Node DOM compatibility, and package-aligned formatter loading.
The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. A high or critical static finding has no usable source path. These conditions do not mean that the AI confirmed malicious behavior.
Package source references a known benign dynamic code generation pattern.
dist/core.esm.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.cjs.jsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/core.cjs.jsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/core.cjs.jsView on unpkg · L1Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/core.cjs.jsView on unpkg · L1A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/core.cjs.jsView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.cjs.jsView on unpkgPackage source references dynamic require/import behavior.
dist/core.cjs.jsView on unpkg · L1Package contains source files above the normal full-analysis size ceiling.
dist/core.cjs.jsView on unpkgThis report applies to sloth-d2c-figma-plugin@2.0.4-beta.14.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references a known benign dynamic code generation pattern.
dist/core.esm.jsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.cjs.jsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/core.cjs.jsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/core.cjs.jsView on unpkg · L1Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/core.cjs.jsView on unpkg · L1A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/core.cjs.jsView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.cjs.jsView on unpkgPackage source references dynamic require/import behavior.
dist/core.cjs.jsView on unpkg · L1Package contains source files above the normal full-analysis size ceiling.
dist/core.cjs.jsView on unpkg