registry / vue-spear-tip / 0.6.34

vue-spear-tip@0.6.34

⚠ Under review

Vue 3 TypeScript Class Components with @Watch, Computed (as getter), @Prop decorators. And UI KIT on them.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 8.12 MB of source, external domains: bun.com, developer.mozilla.org, github.com, nodejs.org, prosemirror.net, pugjs.org, sass-lang.com, stuk.github.io, tailwindcss.com, unocss.dev, vite.dev, w3c.github.io, www.npmjs.com, www.typescriptlang.org, www.w3.org

Source & flagged code

3 flagged

dist/FilesArea-BlitqjL_.cjsView file

Lines 1-23javascript

1"use strict";var at=Object.defineProperty;var b=(a,d)=>at(a,"name",{value:d,configurable:!0});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const Q=require

Source & flagged code

3 flagged · loading source

dist/FilesArea-BlitqjL_.cjsView file

13`,s=new Blob([E],{type:"text/html"});this.pdfUrl=URL.createObjectURL(s)}this.loading=!1}beforeUnmount(){this.pdfUrl&&URL.revokeObjectURL(this.pdfUrl)}},b(Fe,"PdfViewer"),Fe);Ze([Q.... L14: \0`,q+=l(P,2),q+=$.magic,q+=l(S,2),q+=l(D,2),q+=l(ee.crc32,4),q+=l(ee.compressedSize,4),q+=l(ee.uncompressedSize,4),q+=l(W.length,2),q+=l(f.length,2),{fileRecord:k.LOCAL_FILE_HEADE... L15: <br><div class="text-center"><b>• ${m.join("</b><br><b>• ")}</b><br>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/FilesArea-BlitqjL_.cjsView on unpkg · L13

dist/SelectField-8t-KuLrQ.cjsView file

38contains invisible/control Unicode U+200B (zero width space) <U+200B>`);for(var d=a.nextSibling,u="";d;)u+=d.textContent,d=d.nextSibling;u.trim()&&F(a.previousSibling)}else a.previousSibling&&!T(a.previousSibling)||a.before("<U+200B>")}),s.removedNodes.forEach(function(a){a&&a.nodeName=="BR"&&z.call(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/SelectField-8t-KuLrQ.cjsView on unpkg · L38

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-Dq78fBt5.cjs -> dist/SelectField-8t-KuLrQ.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-8t-KuLrQ.cjsView on unpkg

Findings

2 Critical2 Medium6 Low

CriticalTrojan Source Unicodedist/SelectField-8t-KuLrQ.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/SelectField-8t-KuLrQ.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/FilesArea-BlitqjL_.cjs

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

dist/SelectField-8t-KuLrQ.cjsView file

Lines 18-58javascript

18 tabIndex="`).concat(i.a11y.focusableTags?0:-1,`"

19 class="`).concat(i.classNames.tag," ").concat(t.class||"",`"

20 `).concat(this.getAttributes(t),`>

21 <x title='' tabIndex="`).concat(i.a11y.focusableTags?0:-1,'" class="').concat(i.classNames.tagX,`" role='button' aria-label='remove tag'></x>

22 <div>

23 <span `).concat(i.mode==="select"&&i.userInput?"contenteditable='true'":"",` autocapitalize="false" autocorrect="off" spellcheck='false' class="`).concat(i.classNames.tagText,'">').concat(t[i.tagTextProp]||t.value,`</span>

24 </div>

25 </tag>`)},"tag"),dropdown:r(function(t){var e=t.dropdown,i=e.position=="manual";return'<div class="'.concat(i?"":t.classNames.dropdown," ").concat(e.classname,'" role="listbox" aria-labelledby="dropdown" dir="').concat(e.RTL?"rtl":"",`">

26 <div data-selector='tagify-suggestions-wrapper' class="`).concat(t.classNames.dropdownWrapper,`"></div>

27 </div>`)},"dropdown"),dropdownContent:r(function(t){var e=this.settings.templates,i=this.state.dropdown.suggestions;return`

28 `.concat(e.dropdownHeader.call(this,i),`

29 `).concat(t,`

30 `).concat(e.dropdownFooter.call(this,i),`

31 `)},"dropdownContent"),dropdownItem:r(function(t){return"<div ".concat(this.getAttributes(t),`

32 class='`).concat(this.settings.classNames.dropdownItem," ").concat(this.isTagDuplicate(t.value)?this.settings.classNames.dropdownItemSelected:""," ").concat(t.class||"",`'

33 tabindex="0"

34 role="option">`).concat(t.mappedValue||t.value,"</div>")},"dropdownItem"),dropdownHeader:r(function(t){return`<header data-selector='tagify-suggestions-header' class="`.concat(this.settings.classNames.dropdownHeader,'"></header>')},"dropdownHeader"),dropdownFooter:r(function(t){var e=t.length-this.settings.dropdown.maxItems;return e>0?`<footer data-selector='tagify-suggestions-footer' class="`.concat(this.settings.classNames.dropdownFooter,`">

35 `).concat(e,` more items. Refine your search.

36 </footer>`):""},"dropdownFooter"),dropdownItemNoMatch:null};function wt(t,e){(e==null||e>t.length)&&(e=t.length);for(var i=0,s=Array(e);i<e;i++)s[i]=t[i];return s}r(wt,"V");function Tt(t,e){return e!=null&&typeof Symbol<"u"&&e[Symbol.hasInstance]?!!e[Symbol.hasInstance](t):t instanceof e}r(Tt,"R");function jt(t,e){return(function(i){if(Array.isArray(i))return i})(t)||(function(i,s){var a=i==null?null:typeof Symbol<"u"&&i[Symbol.iterator]||i["@@iterator"];if(a!=null){var n,o,l=[],d=!0,u=!1;try{for(a=a.call(i);!(d=(n=a.next()).done)&&(l.push(n.value),!s||l.length!==s);d=!0);}catch(h) ...

37`)),(o=a).replaceWith.apply(o,ot([l].concat(ot(ot(a.childNodes).slice(0,-1))))),F(l)}else if(z.call(e,a))if(((n=a.previousSibling)===null||n===void 0?void 0:n.nodeType)!=3||a.previousSibling.textContent||

38`);for(var d=a.nextSibling,u="";d;)u+=d.textContent,d=d.nextSibling;u.trim()&&F(a.previousSibling)}else a.previousSibling&&!T(a.previousSibling)||a.before("")}),s.removedNodes.forEach(function(a){a&&a.nodeName=="BR"&&z.call(e,i)&&(e.removeTags(i),e.

39`);try{s=s.replace(/(?:\r\n|\r|\n)/g,this.settings.delimiters.source.charAt(0))}catch{}return s=s.replace(/\s/g," "),e?.trim?this.trim(s):s},"normalize"),autocomplete:{suggest:r(function(t){if(this.settings.autoComplete.enabled){typeof(t=t||{value:""})!="object"&&(t={value:t});var e=this.dropdown.getMappedValue(t);if(typeof e!="number"){var i=this.state.inputText.toLowerCase(),s=e.substr(0,this.state.inputText.length).toLowerCase(),a=e.substring(this.state.inputText.length);e&&this.state.inputText&&s==i?(this.DOM.input.setAttribute("data-suggest",a),this.state.inputSuggestion=t):(this.DOM.inpu ...

40`),d&&z.call(e,l)){if(d.__removed)return;t+=a[0]+s(ut(d,e.dataProps))+a[1]}else l.getAttribute("style")||["B","I","U"].includes(l.tagName)?t+=l.textContent:l.tagName!="DIV"&&l.tagName!="P"||(t+=`\r

41`,n(l))}else t+=l.textContent})},"te")(this.DOM.input),t},"getMixedTagsAsString")},et.prototype.removeTag=et.prototype.removeTags;var $t=Object.defineProperty,Ht=Object.getOwnPropertyDescriptor,_=r((t,e,i,s)=>{for(var a=s>1?void

42 <tags class="${a.namespace} ${u} ${i.className}"

43 ${o?"readonly":""}

44 ${l?"disabled":""}

45 ${d?"required":""}

46 ${h?'spellcheck="false"':""}

47 tabIndex="-1" title="">

48 ${this.settings.templates?.input?.call(this)}

49 </tags>

50 `},input(){const{settings:i}=this,{classNames:s,a11y:a,mode:n,placeholder:o}=i;return`

51 <span ${!i.readonly&&i.userInput?"contenteditable":""}

52 data-can-editable

53 tabIndex="0"

54 data-placeholder="${o||""}"

55 aria-placeholder="${o||""}"

56 class="${s.input}"

57 role="textbox"

58 autocapitalize="false"

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/vue-spear-tip.cjs.js -> dist/index-Dq78fBt5.cjs -> dist/SelectField-8t-KuLrQ.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SelectField-8t-KuLrQ.cjsView on unpkg