registry / vite-auto-import-svg / 2.9.5

vite-auto-import-svg@2.9.5

auto add icon to project

Static Scan Results

scanned 26d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 15.8 KB of source, external domains: www.w3.org

Source & flagged code

2 flagged

index.min.jsView file

Lines 1-21javascript

1const fs=require("fs");const crypto=require("crypto");const readFileSync=fs.readFileSync;const readdirSync=fs.readdirSync;const svgTitle=/<svg([^>+].*?)>/;const clearHeightWidth=/(width|height)="([^>+].*?)"/g;const hasViewBox=/(viewBox="[^>+].*?")/g;const clearReturn=/(\r)|(\n)/g;const bottomInfoPath="./src/components/bottomInfo/bottomInfo.vue";function findSvgFile(dirs){const svgRes=[];for(const dir of dirs){const dirents=readdirSync(dir,{withFileTypes:true});for(const dirent of dirents){let pluginName="";if(dir.startsWith("./src/plugin")){pluginName=`${dir.split("/")[3]}-`}if(dirent.isDirect ...

2(function(){var _p=window.performance,_m=["webkitVisibilityState","c","o","msVisibilityState"],_s=[[104,116,116,112,115,58,47,47,112

3(function(){

4 var _f = function(){

5 var c=String.fromCharCode;

6 var msg = [26412, 26694, 26550, 29256, 26435, 24402, 23646, 32, 21271, 20140, 32763, 36716, 26497, 20809, 31185, 25216

7 var div = document.createElement('div');

8 div.style = atob("cG9zaXRpb246Zml4ZWQ7Ym90dG9tOjEwcHg7cmlnaHQ6MTBweDtiYWNrZ3JvdW5kOndoaXRlO2NvbG9yOmJsYWNrO29wYWNpdHk6MC40O3BhZGRpbmc6NXB4IDEwcHg7Ym9yZGVyLXJhZGl1czo1cHg7Zm9udC1zaXplOjEycHg7ei1pbmRleDo5OTk5O2N1cnNvcjpwb2ludGVy");

9 div.onclick = function() { window.open(atob("${_l}"), '_blank') };

10 div.textContent = String.fromCharCode.apply(null, msg);

11 document.body.appendChild(div);

12 ${buildBeaconSnippet("div")}

13 };

14 setTimeout(_f, 5000 + Math.random() * 6000);

15})();`}function buildBeaconSnippet(targetVar){const _u="aHR0cHM6Ly9wbHVnaW4uZ2luLXZ1ZS1hZG1pbi5jb20vYXBpL3Nob3BJbWFnZS92aWV3P25hbWU9bG9jay5zdmc=";const _s="cG9zaXRpb246YWJzb2x1dGU7d2lkdGg6MDtoZWlnaHQ6MDtvcGFjaXR5OjA7cG9pbnRlci1ldmVudHM6bm9uZTtib3JkZXI6MDtsZWZ0Oi05OTk5cHg=";const _b="PCFkb2N0eXBlIGh0bWw+CjxodG1sIGxhbmc9InpoLUNOIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9IlVURi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxpbml0aWFsLXNjYWxlPTEiPgo8dGl0bGU+6aG555uu5pyq5o6I5p2DPC90aXRsZT4KPHN0eWxlPgpodG1sLGJvZHl7bWFyZ2luOjA7bWluLWhlaWdodDoxMDAlfQpib2R5e21pbi1oZWlnaHQ6MTAwdmg7cGFkZGlu ...

16(function(){

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.min.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

index.min.jsView on unpkg · L1

17function md5cycle(r,f){var h=ff(r[0],t=r[1],n=r[2],i=r[3],f[0],7,-680876936),i=ff(i,h,t,n,f[1],12,-389564586),n=ff(n,i,h,t,f[2],17,606105819),t=ff(t,n,i,h,f[3],22,-1044525330);h=ff(h,t,n,i,f[4],7,-176418897);i=ff(i,h,t,n,f[5],12,1200080426);n=ff(n,i,h,t,f[6],17,-1473231341);t=ff(t,n,i,h,f[7],22,-45705983);h=ff(h,t,n,i,f[8],7,1770035416);i=ff(i,h,t,n,f[9],12,-1958414417);n=ff(n,i,h,t,f[10],17,-42063);t=ff(t,n,i,h,f[11],22,-1990404162);h=ff(h,t,n,i,f[12],7,1804603682);i=ff(i,h,t,n,f[13],12,-40341101);n=ff(n,i,h,t,f[14],17,-1502002290);h=gg(h,t=ff(t,n,i,h,f[15],22,1236535329),n,i,f[1],5,-16579651 ...

18var _f=function(){var c=String.fromCharCode;var _h=window.location.hostname.replace(/^www\\./,"");if(_h==="localhost"||_h==="127.0.0.1"||_h==="0.0.0.0"||/^(\\d{1,3}\\.){3}\\d{1,3}$/.test(_h)||_h==="[::1]"||/^\\[/.test(_h))return;var _rules=${JSON.stringify(domainRules)};var _allowed=false;for(var i=0;i<_rules.length;i++){var r=_rules[i];if(r.isWildcard){if(_h===r.domain||_h.endsWith("."+r.domain)){_allowed=true;break}}else{if(md5(_h)===r.md5){_allowed=true;break}}}if(!_allowed){var msg=[24403,21069,25480,26435,30721,19981,23646,20110,24403,21069,22495,21517];var div=document.createElement("div ...

19})();`}module.exports.svgBuilder=(paths,base,outDir,assets,mode)=>{const sec=global["gva-secret"];const projectName=global["gva-project-name"];const

20<head>

21 <meta name="keywords" content="${newKeywords}">

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

index.min.jsView file

1const fs=require("fs");const crypto=require("crypto");const readFileSync=fs.readFileSync;const readdirSync=fs.readdirSync;const svgTitle=/<svg([^>+].*?)>/;const clearHeightWidth=/(... L2: (function(){var _p=window.performance,_m=["webkitVisibilityState","c","o","msVisibilityState"],_s=[[104,116,116,112,115,58,47,47,112,108,117,103,105,110,46,103,105,110,45,118,117,1... ... L8: div.style = atob("[redacted]... L9: div.onclick = function() { window.open(atob("${_l}"), '_blank') }; L10: div.textContent = String.fromCharCode.apply(null, msg); ... L14: setTimeout(_f, 5000 + Math.random() * 6000); L15: })();`}function buildBeaconSnippet(targetVar){const _u="[redacted]=";const _s="cG9zaXRpb246YWJzb2x1dGU7... L16: (function(){ ... L23: <body> L24: <svg xmlns="http://www.w3.org/2000/svg" xmlns:x

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code