registry / yamlover / 0.3.24

yamlover@0.3.24

Browse a yamlover tree in the web: npx yamlover <root> serves a React SPA over a directory.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 6.06 MB of source, external domains: example.com, foo.bar, github.com, goo.gl, i.ytimg.com, leafletjs.com, ns.adobe.com, player.vimeo.com, purl.oclc.org, raw.github.com, reactjs.org, schemas.microsoft.com, schemas.openxmlformats.org, schemas.zwobble.org, sheetjs.com, sheetjs.openxmlformats.org, stuartk.com, stuk.github.io, www.openstreetmap.org, www.plantuml.com, www.w3.org, www.xfa.org, www.youtube-nocookie.com

Oversized source lightweight scan

dist/server.js2.42 MB file, sampled 256 KB

FilesystemChildProcessHighEntropyStrings

Source & flagged code

6 flagged

dist/client/assets/docx-D39uvoU4.jsView file

Lines 5-45javascript

5`:"";return(a.children||[]).map(m).join("")+g}k.convertElementToRawText=m},{"./documents":4}],25:[function(C,ie,k){var D=C("underscore");k.Result=m,k.success=a,k.warning=g,k.error=f;function m(r,d){this.value=r,this.messages=d||[]}m.prototype.map=function(r){return new m(r(this.value),this.messages)},m.prototype.flatMap=function(r){var d=r(this.value);return new m(d.value,s([this,d]))},m.prototype.flatMapThen=function(r){var d=this;return r(this.value).then(function(p){return new m(p.value,s([d,p]))})},m.combine=function(r){var d=D.flatten(D.pluck(r,"value")),p=s(r);return new m(d,p)};function ...

6`,r:"\r",t:" "};function t(R){return R.replace(/\\(.)/g,function(A,Y){return o[Y]||Y})}var n=m.rules.sequence(m.rules.tokenOfType("open-square-bracket"),m.rules.sequence.cut(),m.rules.sequence.capture(y),m.rules.tokenOfType("equals"),m.rules.sequence.capture(h),m.rules.tokenOfType("close-square-bracket")).map(function(R,A){return{name:R,value:A,append:!1}}),b=m.rules.sequence(m.rules.tokenOfType("dot"),m.rules.sequence.cut(),m.rules.sequence.capture(y)).map(function(R){return{name:"class",value:R,append:!0}}),U=m.rules.firstOf("attribute or class",n,b);function M(R,A){var Y=f(A),ae=m.Parser(), ...

7`+A.errors().map(W).join(`

8`)}function W(R){return"Error was at character number "+R.characterNumber()+": Expected "+R.expected+" but got "+R.actual}var I=e()},{"./results":25,"./styles/document-matchers":27,"./styles/html-paths":28,"./styles/parser/tokeniser":29,lop:89,underscore:102}],27:[function(C,ie,k){k.paragraph=D,k.run=m,k.table=a,k.bold=new f("bold"),k.italic=new f("italic"),k.underline=new f("underline"),k.strikethrough=new f("strikethrough"),k.allCaps=new f("allCaps"),k.smallCaps=new f("smallCaps"),k.highlight=g,k.commentReference=new f("commentReference"),k.lineBreak=new i({breakType:"line"}),k.pageBreak=new ...

9`,`

10`+r);y.text(W)}function t(E,W){U(),y.selfClosing(E,W)}function n(){return d.length===0||a[d[d.length-1]]}function b(){c||(U(),c=!0)}function

11`);for(var E=0;E<e;E++)y._append(r)}}function M(){return D.some(d,function(E){return E==="pre"})}return{asString:y.asString,open:u,close:h,text:o,selfClosing:t}}function f(){var e=[];function

12`:"",end:u?"":`

13`,list:{isOrdered:c.isOrdered,indent:u?u.indent+1:0,count:0}}}}function i(c,y,u){y=y||{indent:0,isOrdered:!1,count:0},y.count++,u.hasClosed=!1;var h=y.isOrdered?y.count+".":"-",o=r(" ",y.indent)+h+" ";return{start:o,end:function(){if(!u.hasClosed)return u.hasClosed=!0,`

14`}}}var e={p:a("",`

16`),br:a("",`

17`),ul:s({isOrdered:!1}),ol:s({isOrdered:!0}),li:i,strong:m("__"),em:m("*"),a:g,img:f};(function(){for(var c=1;c<=6;c++)e["h"+c]=a(r("#",c)+" ",`

19`)})();function r(c,y){return new Array(y+1).join(c)}function d(){var c=[],y=[],u=null,h={};function o(E,W){W=W||{};var I=e[E]||function(){return{}},R=I(W,u,h);y.push({end:R.end,list:u}),R.list&&(u=R.list);var A=R.anchorPosition==="before";A&&t(W),c.push(R.start||""),A||t(W)}function t(E){E.id&&c.push('<a id="'+E.id+'"></a>')}function n(E){var W=y.pop();u=W.list;var I=D.isFunction(W.end)?W.end():W.end;c.push(I||"")}function b(E,W){o(E,W),n()}function U(E){c.push(p(E))}function M(){return c.join("")}return{asString:M,open:o,close:n,text:U,selfClosing:b}}k.writer=d;function p(c){return c.replace ...

20`).replace(/[\r\u0085\u2028]/g,`

21`)}function d(t){this.options=t||{locator:{}}}d.prototype.parseFromString=function(t,n){var b=this.options,U=new e,M=b.domBuilder||new c,E=b.errorHandler,W=b.locator,I=b.xmlns||{},R=

22@`+(t.systemId||"")+"#[line:"+t.lineNumber+",col:"+t.columnNumber+"]"}function h(t,n,b){return typeof t=="string"?t.substr(n,b):t.length>=n+b||n?new java.lang.String(t,n,b)+"":t}"endDTD,startEntity,endEntity,attributeDecl,elementDecl,externalEntityDecl,internalEntityDecl,resolveEntity,getExternalSubset,notationDecl,unparsedEntityDecl".replace(/\w+/g,function(t){c.prototype[t]=function(){return null}});function o(t,n){t.currentElement?t.currentElement.appendChild(n):t.doc.appendChild(n)}k.__DOMHandler=c,k.normalizeLineEndings=r,k.DOMParser=d},{"./conventions":41,"./dom":43,"./entities":44,"./sa ...

23`),D.exit(2)):this.throwLater(d)},s.prototype.throwLater=function(d,p){if(arguments.length===1&&(p=d,d=function(){throw p}),typeof setTimeout<"u")setTimeout(function(){d(p)},

25 See http://goo.gl/MqrFmX

26`)}};function i(d,p,c){this._lateQueue.push(d,p,c),this._queueTick()}function e(d,p,c){this._normalQueue.push(d,p,c),this.

27 return function(obj) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/docx-D39uvoU4.jsView on unpkg · L25

28 'use strict'

29 var len = this.length;

30 ensureMethod(obj, 'methodName');

31 switch(len) {

32 case 1: return obj.methodName(this[0]);

33 case 2: return obj.methodName(this[0], this[1]);

34 case 3: return obj.methodName(this[0], this[1], this[2]);

35 case 0: return obj.methodName();

36 default:

37 return obj.methodName.apply(obj, this);

38 }

39 };

40 `.replace(/methodName/g,t))(y)},p=function(t){return new Function("obj",`

41 'use strict';

42 return obj.propertyName;

43 `.replace("propertyName",t))},c=function(t,n,b){var U=b[t];if(typeof U!="function"){if(!i(t))return null;if(U=n(t),b[t]=U,b[" size"]++,b[" size"]>512){for(var M=Object.keys(b),E=0;E<256;++E)delete b[M[E]];b[" size"]=M.length-256}}return U};e=function(t){return c(t,d,m)},r=function(t){return c(t,p,a)}}function y(t,n){var b;if(t!=null&&(b=t[n]),typeof b!="function"){var U="Object "+f.classString(t)+" has no method '"+f.toString(n)+"'";throw new g.TypeError(U)}return b}function u(t){var n=this.pop(),b=y(t,n);return b.apply(t,this)}g.prototype.call=function(t){for(var n=arguments.length,b= ...

45 See http://goo.gl/MqrFmX

Long lines were clipped for display.

bin/yamlover.jsView file

Lines 130-170javascript

130 res.end("not found");

131 return;

132 }

133 }

134 if (url.pathname.startsWith("/api/")) {

135 handle(req, res, url);

136 return;

137 }

138

dist/wasm/webp_dec.wasmView file

•path = dist/wasm/webp_dec.wasm kind = wasm_module sizeBytes = 137960 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/webp_dec.wasmView on unpkg

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 2541761 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/client/assets/docx-D39uvoU4.jsView file

25See http://goo.gl/MqrFmX L26: `)}};function i(d,p,c){this._lateQueue.push(d,p,c),this._queueTick()}function e(d,p,c){this._normalQueue.push(d,p,c),this._queueTick()}function r(d){this._normalQueue._pushOne(d),t... L27: return function(obj) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/docx-D39uvoU4.jsView on unpkg · L25

bin/yamlover.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = yamlover@0.3.23 matchedIdentity = npm:eWFtbG92ZXI:0.3.23 similarity = 0.941 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/yamlover.jsView on unpkg

150} L151: ({ createHandlers } = await import(pathToFileURL(join(pkgRoot, "dist/server.js")).href)); L152: serveClient = (req, res, url) => serveStatic(res, url, distClient, distIndex);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yamlover.jsView on unpkg · L150

dist/wasm/webp_dec.wasmView file

•path = dist/wasm/webp_dec.wasm kind = wasm_module sizeBytes = 137960 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/webp_dec.wasmView on unpkg

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 2541761 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg

Findings

4 High6 Medium5 Low

HighObfuscated

HighShips High Entropy Blobdist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Filedist/server.js

HighPrevious Version Dangerous Deltabin/yamlover.js

MediumDynamic Requirebin/yamlover.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/wasm/webp_dec.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/client/assets/docx-D39uvoU4.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/client/assets/docx-D39uvoU4.jsView file

Lines 5-45javascript

7`+A.errors().map(W).join(`

9`,`

10`+r);y.text(W)}function t(E,W){U(),y.selfClosing(E,W)}function n(){return d.length===0||a[d[d.length-1]]}function b(){c||(U(),c=!0)}function

11`);for(var E=0;E<e;E++)y._append(r)}}function M(){return D.some(d,function(E){return E==="pre"})}return{asString:y.asString,open:u,close:h,text:o,selfClosing:t}}function f(){var e=[];function

12`:"",end:u?"":`

14`}}}var e={p:a("",`

16`),br:a("",`

17`),ul:s({isOrdered:!1}),ol:s({isOrdered:!0}),li:i,strong:m("__"),em:m("*"),a:g,img:f};(function(){for(var c=1;c<=6;c++)e["h"+c]=a(r("#",c)+" ",`

20`).replace(/[\r\u0085\u2028]/g,`

21`)}function d(t){this.options=t||{locator:{}}}d.prototype.parseFromString=function(t,n){var b=this.options,U=new e,M=b.domBuilder||new c,E=b.errorHandler,W=b.locator,I=b.xmlns||{},R=

23`),D.exit(2)):this.throwLater(d)},s.prototype.throwLater=function(d,p){if(arguments.length===1&&(p=d,d=function(){throw p}),typeof setTimeout<"u")setTimeout(function(){d(p)},

25 See http://goo.gl/MqrFmX

26`)}};function i(d,p,c){this._lateQueue.push(d,p,c),this._queueTick()}function e(d,p,c){this._normalQueue.push(d,p,c),this.

27 return function(obj) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/docx-D39uvoU4.jsView on unpkg · L25

28 'use strict'

29 var len = this.length;

30 ensureMethod(obj, 'methodName');

31 switch(len) {

32 case 1: return obj.methodName(this[0]);

33 case 2: return obj.methodName(this[0], this[1]);

34 case 3: return obj.methodName(this[0], this[1], this[2]);

35 case 0: return obj.methodName();

36 default:

37 return obj.methodName.apply(obj, this);

38 }

39 };

40 `.replace(/methodName/g,t))(y)},p=function(t){return new Function("obj",`

41 'use strict';

42 return obj.propertyName;

45 See http://goo.gl/MqrFmX

Long lines were clipped for display.

bin/yamlover.jsView file

Lines 130-170javascript

130 res.end("not found");

131 return;

132 }

133 }

134 if (url.pathname.startsWith("/api/")) {

135 handle(req, res, url);

136 return;

137 }

138

dist/wasm/webp_dec.wasmView file

•path = dist/wasm/webp_dec.wasm kind = wasm_module sizeBytes = 137960 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/webp_dec.wasmView on unpkg

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 2541761 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg