Loading npm security reports…

sy-form-designer@1.0.70: Clean npm security report (Allow) | LPM Firewall

registry / sy-form-designer / 1.0.70

sy-form-designer@1.0.70

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Runtime dynamic code is limited to form-designer configuration supplied by the consuming application, and MediaPipe fetches package-aligned model/WASM paths.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A host application renders a configured form or explicitly uses the face-landmarker feature.

Impact

Configured form code can run in the host page context; no package-initiated exfiltration, persistence, or install-time mutation was found.

Mechanism

User-configured form handlers and relative MediaPipe asset loading.

Rationale

The scanner findings are explained by bundled UI/editor, Vue, and MediaPipe artifacts. The remaining dynamic execution is package-aligned and requires host-provided form configuration, with no concrete malicious chain.

Evidence

package.jsonindex.jsrender-B-C5I6yk.jsossHook-HizPWSM1.jsindex-C1OyATSu.jsmediapipe/wasm/vision_wasm_internal.jsindex-Dpr7_0MJ.jsmodels/face_landmarker.task

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with high false-positive risk.

Evidence for block

`render-B-C5I6yk.js` evaluates configured regex strings and form event-handler text with `eval`/`new Function` at runtime.
`ossHook-HizPWSM1.js` loads a face-landmarker model and bundled MediaPipe WASM resources via configurable relative paths.
`index-C1OyATSu.js` contains bidi controls in bundled Ace editor bidi-handling strings.

Evidence against

`package.json` has no preinstall, install, postinstall, bin, or lifecycle execution hook.
Published entry `index.js` only imports the Vue component bundle `index-Dpr7_0MJ.js`.
No `child_process` import or shell-command invocation was found; scanner `exec` matches are ordinary method calls such as regex execution.
MediaPipe Node `fs` code in `mediapipe/wasm/vision_wasm_internal.js` is an Emscripten loader for packaged WASM assets.
No credential harvesting, exfiltration endpoint, destructive filesystem operation, or AI-agent control-surface write was found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEval

Source & flagged code

7 flagged

index.umd.cjsView file

20* Released under the MIT License. L21: */function initFeatureFlags$1(){typeof __INTLIFY_PROD_DEVTOOLS__!="boolean"&&(getGlobalThis().__INTLIFY_PROD_DEVTOOLS__=!1),typeof __INTLIFY_DROP_MESSAGE_COMPILER__!="boolean"&&(ge... L22: ${Ja}`:Ha)}else throw Qa},onCacheKey:Qa=>generateFormatCacheKey($a,ka,Qa)}}function getSourceForCodeFrame(Sa){if(isString$1(Sa))return Sa;if(Sa.loc&&Sa.loc.source)return Sa.loc.sou... ... L26: */const VERSION$2="11.1.2";function initFeatureFlags(){typeof __VUE_I18N_FULL_INSTALL__!="boolean"&&(getGlobalThis().__VUE_I18N_FULL_INSTALL__=!0),typeof __VUE_I18N_LEGACY_API__!="... L27: About how to use the Composition API mode, see https://vue-i18n.intlify.dev/guide/advanced/composition.html`,[I18nWarnCodes.DEPRECATE_TRANSLATE_CUSTOME_DIRECTIVE]:"'v-t' has been d... L28: `).forEach(function(Qa){Xa=Qa.indexOf(":"),ka=Qa.substring(0,Xa).trim().toLowerCase(),Da=Qa.substring(Xa+1).trim(),!(!ka||$a[ka]&&ignoreDuplicateOf[ka])&&(ka==="set-cookie"?$a[ka]?... ... L31: `):" "+renderReason(Wa[0]):"as no adapter specified";throw new AxiosError$1("There is no suitable adapter to dispatch the request "+Qa,"ERR_NOT_SUPPORT")}return Da},adapters:knownA... L32: `+Wa):Da.stack

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.umd.cjsView on unpkg · L20

1(function(Sa,$a){typeof exports=="object"&&typeof module<"u"?module.exports=$a(require("vue"),require("vuedraggable")):typeof define=="function"&&define.amd?define(["vue","vuedragg... L2: * @vue/shared v3.5.13

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.umd.cjsView on unpkg · L1

31`):" "+renderReason(Wa[0]):"as no adapter specified";throw new AxiosError$1("There is no suitable adapter to dispatch the request "+Qa,"ERR_NOT_SUPPORT")}return Da},adapters:knownA... L32: `+Wa):Da.stack=Wa}catch{}}throw Da}}_request($a,ka){typeof $a=="string"?(ka=ka||{},ka.url=$a):ka=$a||{},ka=mergeConfig$1(this.defaults,ka);const{transitional:Da,paramsSerializer:Xa... L33: /*# sourceURL=ace/css/`+Ka+" */");var el=Da.createElement("style");el.appendChild(qa.createTextNode(ja)),Ka&&(el.id=Ka),Ya==qa&&(Ya=Da.getDocumentHead(qa)),Ya.insertBefore(el,Ya.fi...

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.umd.cjsView on unpkg · L31

index-C1OyATSu.jsView file

3038contains invisible/control Unicode U+202B (right-to-left embedding) B[B.length - 1] === A.DOT && (K[B.length - 1] = A.B), B[0] === "<U+202B>" && (K[0] = A.RLE);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

index-C1OyATSu.jsView on unpkg · L3038

•Trigger-reachable chain: manifest.main -> index.js -> index-Dpr7_0MJ.js -> widgets-BqjJftc2.js -> index-C1OyATSu.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index-C1OyATSu.jsView on unpkg

mediapipe/wasm/vision_wasm_nosimd_internal.wasmView file

•path = mediapipe/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 10481398 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

mediapipe/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

models/face_landmark_68_model-shard1View file

•path = models/face_landmark_68_model-shard1 kind = high_entropy_blob sizeBytes = 356840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

models/face_landmark_68_model-shard1View on unpkg

Source & flagged code

7 flagged · loading source

index.umd.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.umd.cjsView on unpkg · L20

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Findings

2 Critical4 High6 Medium5 Low

CriticalTrojan Source Unicodeindex-C1OyATSu.js

CriticalTrigger Reachable Dangerous Capabilityindex-C1OyATSu.js

HighChild Process

HighShell

HighSame File Env Network Executionindex.umd.cjs

HighShips High Entropy Blobmodels/face_landmark_68_model-shard1

MediumDynamic Requireindex.umd.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Modulemediapipe/wasm/vision_wasm_nosimd_internal.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalindex.umd.cjs

Source & flagged code

7 flagged

index.umd.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.umd.cjsView on unpkg · L20

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.umd.cjsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.umd.cjsView on unpkg · L31

index-C1OyATSu.jsView file

3038contains invisible/control Unicode U+202B (right-to-left embedding) B[B.length - 1] === A.DOT && (K[B.length - 1] = A.B), B[0] === "<U+202B>" && (K[0] = A.RLE);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

index-C1OyATSu.jsView on unpkg · L3038

•Trigger-reachable chain: manifest.main -> index.js -> index-Dpr7_0MJ.js -> widgets-BqjJftc2.js -> index-C1OyATSu.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index-C1OyATSu.jsView on unpkg

mediapipe/wasm/vision_wasm_nosimd_internal.wasmView file

•path = mediapipe/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 10481398 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

mediapipe/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

models/face_landmark_68_model-shard1View file

•path = models/face_landmark_68_model-shard1 kind = high_entropy_blob sizeBytes = 356840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

models/face_landmark_68_model-shard1View on unpkg