registry / vue-spear-tip / 0.6.34

vue-spear-tip@0.6.34

⚠ Under review

Vue 3 TypeScript Class Components with @Watch, Computed (as getter), @Prop decorators. And UI KIT on them.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 8.12 MB of source, external domains: bun.com, developer.mozilla.org, github.com, nodejs.org, prosemirror.net, pugjs.org, sass-lang.com, stuk.github.io, tailwindcss.com, unocss.dev, vite.dev, w3c.github.io, www.npmjs.com, www.typescriptlang.org, www.w3.org

Source & flagged code

3 flagged

dist/FilesArea-BlitqjL_.cjsView file

Lines 1-23javascript

1"use strict";var at=Object.defineProperty;var b=(a,d)=>at(a,"name",{value:d,configurable:!0});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const Q=require("./index-Dq78fBt5.cjs"),st=require("./FieldComponent.vue_vue_type_script_lang-D40_-8Ww.cjs"),t=require("vue"),xe=require("./_commonjsHelpers-BB06FEA1.cjs");var lt=Object.defineProperty,dt=Object.getOwnPropertyDescriptor,be=b((a,d,h,E)=>{for(var s=E>1?void 0:E?dt(d,h):d,l=a.length-1,i;l>=0;l--)(i=a[l])&&(s=(E?i(d,h,s):i(s))||s);return E&&s&&lt(d,h,s),s},"__decorateClass$6"),ze;let ve=(ze=class extends Q.BaseComponent{com ...

2 <html>

3 <head>

4 <style>

5 body, html { margin: 0; padding: 0; background: #2c3e50; box-sizing: border-box; }

6 embed { width: 100vw; height: 100vh; } /* Пример стиля */

7 </style>

8 </head>

9 <body>

10 <embed src="${URL.createObjectURL(d)}" type="application/pdf">

11 </body>

12 </html>

13 `,s=new Blob([E],{type:"text/html"});this.pdfUrl=URL.createObjectURL(s)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Fe,"PdfViewer"),Fe);Ze([Q.Prop(String)],Ie.prototype,"uri",2);Ze([Q.Prop(String)],Ie.prototype,"ext",2);Ze([Q.Prop(String)],Ie.prototype,"fileName",2);Ie=Ze([Q.VST],Ie);const zn={class:"pdf-container h100vh w-full fixed l-0 t-50px bg-white p-0"},Nn={key:0,class:"absolute t-0 l-0 bg-white/80 text-lightblue-600 flex items-center justify-center w100% h100%"},Cn={key:1,class:"bg-white h[calc(100vh-50px)] w100vw fixed p-0"},Sn=["src"];function ...

14\0`,q+=l(P,2),q+=$.magic,q+=l(S,2),q+=l(D,2),q+=l(ee.crc32,4),q+=l(ee.compressedSize,4),q+=l(ee.uncompressedSize,4),q+=l(W.length,2),q+=l(f.length,2),{fileRecord:k.LOCAL_FILE_HEADER+q+W+f,dirRecord:k.CENTRAL_FILE_HEADER+l(re,2)+q+l(te.length,2)+"\0\0\0\0"+l(O,4)+l(y,4)+W+f+te}}b(i,"n");var o=h("../utils"),m=h("../stream/GenericWorker"),w=h("../utf8"),x=h("../crc32"),k=h("../signature");function C(c,v,u,y){m.call(

15 <br><div class="text-center"><b>• ${m.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/FilesArea-BlitqjL_.cjsView on unpkg · L13

16 <br>Поддерживаемые расширения файлов для загрузки:<br>

17 <b>.jpeg .jpg .png .svg .svgz .gif .bmp .webp .avif .apng .webp .jfif, .pgp</b></div>`},"warning"),w.length&&this.errorHandler?.({title:"Внимание!",width:"450px",message:`<div class="text-center">Следующие файлы не были добавлены:</div>

18 <br><div class="text-center"><b>• ${w.join("</b><br><b>• ")}</b><br><br>

19 Устновлено ограничение на количество: <u><b>${this.maxNumberOfFiles}</b></u>

20 </div>`},"warning"),x.length&&this.errorHandler?.({title:"Внимание!",width:"450px",message:`<div class="text-center">Следующие файлы не были добавлены, потому что максимальный размер

21 загружаемого изображения не должно превышать <b>${this.fileGetSize(this.maxSize*1024*1024)}</b>:</div>

22 <br><div class="text-center"><b>• ${x.join("</b><br><b>• ")}</b><br><br></div>`},"warning"),!E.has("files[]")){const v=Object.keys(l).length;v&&this.errorHandler?.({title:"Ошибка",message:`Так${v==1?"ой":"ие"} файл${v==1?"":"ы"} уже есть`}),this.onUploadInProcess=!1;return}const k=new XMLHttpRequest,C=this.uploadPath;k.open("POST",C,!0);let c={};this.uploadHeaders&&(typeof this.uploadHeaders=="function"?c=this.uploadHeaders():c=this.uploadHeaders);for(const v in c)k.setRequestHeader(v,c[v]);k.upload.addEventListener("progress",v=>{if

Long lines were clipped for display.

dist/SelectField-8t-KuLrQ.cjsView file

Lines 18-58javascript

18 tabIndex="`).concat(i.a11y.focusableTags?0:-1,`"

19 class="`).concat(i.classNames.tag," ").concat(t.class||"",`"

20 `).concat(this.getAttributes(t),`>

21 <x title='' tabIndex="`).concat(i.a11y.focusableTags?0:-1,'" class="').concat(i.classNames.tagX,`" role='button' aria-label

Source & flagged code

3 flagged · loading source

dist/FilesArea-BlitqjL_.cjsView file

13`,s=new Blob([E],{type:"text/html"});this.pdfUrl=URL.createObjectURL(s)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Fe,"PdfViewer"),Fe);Ze([Q.... L14: \0`,q+=l(P,2),q+=$.magic,q+=l(S,2),q+=l(D,2),q+=l(ee.crc32,4),q+=l(ee.compressedSize,4),q+=l(ee.uncompressedSize,4),q+=l(W.length,2),q+=l(f.length,2),{fileRecord:k.LOCAL_FILE_HEADE... L15: <br><div class="text-center"><b>• ${m.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/FilesArea-BlitqjL_.cjsView on unpkg · L13

dist/SelectField-8t-KuLrQ.cjsView file

38contains invisible/control Unicode U+200B (zero width space) <U+200B>`);for(var d=a.nextSibling,u="";d;)u+=d.textContent,d=d.nextSibling;u.trim()&&F(a.previousSibling)}else a.previousSibling&&!T(a.previousSibling)||a.before("<U+200B>")}),s.removedNodes.forEach(function(a){a&&a.nodeName=="BR"&&z.call(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/SelectField-8t-KuLrQ.cjsView on unpkg · L38

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-Dq78fBt5.cjs -> dist/SelectField-8t-KuLrQ.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-8t-KuLrQ.cjsView on unpkg

Findings

2 Critical2 Medium6 Low

CriticalTrojan Source Unicodedist/SelectField-8t-KuLrQ.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/SelectField-8t-KuLrQ.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/FilesArea-BlitqjL_.cjs

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

dist/FilesArea-BlitqjL_.cjsView file

Lines 1-23javascript

2 <html>

3 <head>

4 <style>

5 body, html { margin: 0; padding: 0; background: #2c3e50; box-sizing: border-box; }

6 embed { width: 100vw; height: 100vh; } /* Пример стиля */

7 </style>

8 </head>

9 <body>

10 <embed src="${URL.createObjectURL(d)}" type="application/pdf">

11 </body>

12 </html>

15 <br><div class="text-center"><b>• ${m.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/FilesArea-BlitqjL_.cjsView on unpkg · L13

16 <br>Поддерживаемые расширения файлов для загрузки:<br>

18 <br><div class="text-center"><b>• ${w.join("</b><br><b>• ")}</b><br><br>

19 Устновлено ограничение на количество: <u><b>${this.maxNumberOfFiles}</b></u>

21 загружаемого изображения не должно превышать <b>${this.fileGetSize(this.maxSize*1024*1024)}</b>:</div>

Long lines were clipped for display.

dist/SelectField-8t-KuLrQ.cjsView file

Lines 18-58javascript

18 tabIndex="`).concat(i.a11y.focusableTags?0:-1,`"

19 class="`).concat(i.classNames.tag," ").concat(t.class||"",`"

20 `).concat(this.getAttributes(t),`>

21 <x title='' tabIndex="`).concat(i.a11y.focusableTags?0:-1,'" class="').concat(i.classNames.tagX,`" role='button' aria-label