registry / widget.qw / 1.1.0

widget.qw@1.1.0

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 1.61 MB of source, external domains: momentjs.com, npms.io

Source & flagged code

3 flagged

.env.productionView file

Lines 1-9text

1NODE_ENV ='production'

3VITE_DOMAIN= 'https://www.hbhjhx.asia'

4VITE_TOKEN_KEY='Authorization'

5VITE_TOKEN_PREFIX='Bearer '

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.productionView on unpkg · L4

6VITE_NEED_LOGIN_CODE=401

7# 注意：发布时 VITE_IS_DEBUG必须配置为false

8# 本地开发时 VITE_IS_DEBUG必须配置为true

9VITE_IS_DEBUG=false

build/widget.qw.umd.jsView file

10818console.log("\u8868\u8FBE\u5F0F:" + newExpress); L10819: return eval(newExpress); L10820: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/widget.qw.umd.jsView on unpkg · L10818

public/favicon.icoView file

•path = public/favicon.ico kind = high_entropy_blob sizeBytes = 4147 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/favicon.icoView on unpkg

Source & flagged code

3 flagged · loading source

.env.productionView file

4patternName = blocked_file severity = critical matchedText = .env.production redactedSecretContext = secretLikeLines = 2 L4: VITE_TOKEN_KEY=<redacted:13 value> L5: VITE_TOKEN_PREFIX=<redacted:6 value>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.productionView on unpkg · L4

build/widget.qw.umd.jsView file

10818console.log("\u8868\u8FBE\u5F0F:" + newExpress); L10819: return eval(newExpress); L10820: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/widget.qw.umd.jsView on unpkg · L10818

public/favicon.icoView file

•path = public/favicon.ico kind = high_entropy_blob sizeBytes = 4147 magicHex = [redacted]

Findings

1 Critical1 High2 Medium5 Low

CriticalCritical Secret.env.production

HighShips High Entropy Blobpublic/favicon.ico

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalbuild/widget.qw.umd.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings