Loading npm security reports…

sy-form-designer@1.0.71: Clean npm security report (Allow) | LPM Firewall

registry / sy-form-designer / 1.0.71

sy-form-designer@1.0.71

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed package-originated attack surface was established. The runtime form renderer deliberately executes consumer-provided callback/condition strings, and upload requests use consumer-supplied endpoints.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A host application renders a form containing configured callbacks, conditions, or upload settings.

Impact

No evidence of install-time execution, credential harvesting, persistence, destructive actions, or hardcoded exfiltration.

Mechanism

User-configured browser-side form scripting and caller-configured uploads.

Rationale

The flagged primitives are bundled UI, Ace editor, Axios/MediaPipe, and intentional form-designer extension behavior. Static inspection found no concrete malicious chain or package-controlled network destination.

Evidence

package.jsonindex.jsrender-Dr7EdUWC.jsindex-C1OyATSu.jsossHook-BqWW5SVB.jsindex-EFT3F905.jsindex-BwkQaHb8.jsmediapipe/wasm/vision_wasm_nosimd_internal.wasmmodels/face_landmark_68_model-shard1

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with high false-positive risk.

Evidence for block

`render-Dr7EdUWC.js` compiles form-supplied callbacks and conditions with `new Function`.
`render-Dr7EdUWC.js` evaluates configurable validation regex strings.
`ossHook-BqWW5SVB.js` can upload files, but targets come from supplied request/signature settings.

Evidence against

`package.json` has no preinstall, install, postinstall, prepare, or bin hook.
`index.js` only exports the Vue package entry chunk.
No child-process or filesystem-write API appears outside bundled MediaPipe runtime.
Upload URLs default to empty and are supplied by the consuming application.
`index-C1OyATSu.js` bidi controls occur in bundled Ace editor bidi support, not hidden executable logic.
Model shards and `.wasm` assets are local ML/runtime data; no package-originated remote payload URL was found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

Source & flagged code

7 flagged

index.umd.cjsView file

20* Released under the MIT License. L21: */function initFeatureFlags$1(){typeof __INTLIFY_PROD_DEVTOOLS__!="boolean"&&(getGlobalThis().__INTLIFY_PROD_DEVTOOLS__=!1),typeof __INTLIFY_DROP_MESSAGE_COMPILER__!="boolean"&&(ge... L22: ${Ja}`:Ha)}else throw Qa},onCacheKey:Qa=>generateFormatCacheKey($a,ka,Qa)}}function getSourceForCodeFrame(Sa){if(isString$1(Sa))return Sa;if(Sa.loc&&Sa.loc.source)return Sa.loc.sou... ... L26: */const VERSION$2="11.1.2";function initFeatureFlags(){typeof __VUE_I18N_FULL_INSTALL__!="boolean"&&(getGlobalThis().__VUE_I18N_FULL_INSTALL__=!0),typeof __VUE_I18N_LEGACY_API__!="... L27: About how to use the Composition API mode, see https://vue-i18n.intlify.dev/guide/advanced/composition.html`,[I18nWarnCodes.DEPRECATE_TRANSLATE_CUSTOME_DIRECTIVE]:"'v-t' has been d... L28: `).forEach(function(Qa){Xa=Qa.indexOf(":"),ka=Qa.substring(0,Xa).trim().toLowerCase(),Da=Qa.substring(Xa+1).trim(),!(!ka||$a[ka]&&ignoreDuplicateOf[ka])&&(ka==="set-cookie"?$a[ka]?... ... L31: `):" "+renderReason(Wa[0]):"as no adapter specified";throw new AxiosError$1("There is no suitable adapter to dispatch the request "+Qa,"ERR_NOT_SUPPORT")}return Da},adapters:knownA... L32: `+Wa):Da.stack

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.umd.cjsView on unpkg · L20

1(function(Sa,$a){typeof exports=="object"&&typeof module<"u"?module.exports=$a(require("vue"),require("vuedraggable")):typeof define=="function"&&define.amd?define(["vue","vuedragg... L2: * @vue/shared v3.5.13

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.umd.cjsView on unpkg · L1

31`):" "+renderReason(Wa[0]):"as no adapter specified";throw new AxiosError$1("There is no suitable adapter to dispatch the request "+Qa,"ERR_NOT_SUPPORT")}return Da},adapters:knownA... L32: `+Wa):Da.stack=Wa}catch{}}throw Da}}_request($a,ka){typeof $a=="string"?(ka=ka||{},ka.url=$a):ka=$a||{},ka=mergeConfig$1(this.defaults,ka);const{transitional:Da,paramsSerializer:Xa... L33: /*# sourceURL=ace/css/`+Ka+" */");var el=Da.createElement("style");el.appendChild(qa.createTextNode(ja)),Ka&&(el.id=Ka),Ya==qa&&(Ya=Da.getDocumentHead(qa)),Ya.insertBefore(el,Ya.fi...

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.umd.cjsView on unpkg · L31

index-C1OyATSu.jsView file

3038contains invisible/control Unicode U+202B (right-to-left embedding) B[B.length - 1] === A.DOT && (K[B.length - 1] = A.B), B[0] === "<U+202B>" && (K[0] = A.RLE);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

index-C1OyATSu.jsView on unpkg · L3038

•Trigger-reachable chain: manifest.main -> index.js -> index-BwkQaHb8.js -> widgets-Dp7ODRlt.js -> index-C1OyATSu.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index-C1OyATSu.jsView on unpkg

mediapipe/wasm/vision_wasm_nosimd_internal.wasmView file

•path = mediapipe/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 10481398 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

mediapipe/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

models/face_landmark_68_model-shard1View file

•path = models/face_landmark_68_model-shard1 kind = high_entropy_blob sizeBytes = 356840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

models/face_landmark_68_model-shard1View on unpkg

Source & flagged code

7 flagged · loading source

index.umd.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.umd.cjsView on unpkg · L20

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Findings

2 Critical4 High6 Medium5 Low

CriticalTrojan Source Unicodeindex-C1OyATSu.js

CriticalTrigger Reachable Dangerous Capabilityindex-C1OyATSu.js

HighChild Process

HighShell

HighSame File Env Network Executionindex.umd.cjs

HighShips High Entropy Blobmodels/face_landmark_68_model-shard1

MediumDynamic Requireindex.umd.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Modulemediapipe/wasm/vision_wasm_nosimd_internal.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalindex.umd.cjs

Source & flagged code

7 flagged

index.umd.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.umd.cjsView on unpkg · L20

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.umd.cjsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.umd.cjsView on unpkg · L31

index-C1OyATSu.jsView file

3038contains invisible/control Unicode U+202B (right-to-left embedding) B[B.length - 1] === A.DOT && (K[B.length - 1] = A.B), B[0] === "<U+202B>" && (K[0] = A.RLE);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

index-C1OyATSu.jsView on unpkg · L3038

•Trigger-reachable chain: manifest.main -> index.js -> index-BwkQaHb8.js -> widgets-Dp7ODRlt.js -> index-C1OyATSu.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index-C1OyATSu.jsView on unpkg

mediapipe/wasm/vision_wasm_nosimd_internal.wasmView file

•path = mediapipe/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 10481398 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

mediapipe/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

models/face_landmark_68_model-shard1View file

•path = models/face_landmark_68_model-shard1 kind = high_entropy_blob sizeBytes = 356840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

models/face_landmark_68_model-shard1View on unpkg