registry / ywana-core8 / 0.2.126

ywana-core8@0.2.126

ywana-core8

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 310 file(s), 3.95 MB of source, external domains: ana-garcia.dev, ana.dev, api.example.com, api.ywana.com, carlos-dev.io, commondatastorage.googleapis.com, concepto.de, des.ywanadigital.com, ejemplo.com, example.com, fb.me, filesamples.com, httpbin.org, i.pravatar.cc, images.unsplash.com, img.freepik.com, invalid-url-that-will-fail.com, invalid-url.com, jsonplaceholder.typicode.com, laura.test, mariaruiz.com, mi-servidor.com, mozilla.github.io, pedro-martin.es, picsum.photos, t4.ftcdn.net, this-does-not-exist.invalid, via.placeholder.com, www.ejemplo.com, www.fileformat.info, www.soundhelix.com, www.w3.org, www.w3schools.com

Oversized source lightweight scan

dist/index.js7.23 MB file, sampled 256 KB

NetworkEnvironmentVarsHighEntropyStringsUrlStringsfb.me

dist/index.modern.js7.27 MB file, sampled 256 KB

NetworkEnvironmentVarsHighEntropyStringsUrlStringsfb.me

dist/index.umd.js7.38 MB file, sampled 256 KB

NetworkEnvironmentVarsHighEntropyStringsUrlStringsfb.me

Source & flagged code

13 flagged

src/desktop/FTPConnectionDialog.jsxView file

Lines 57-97jsx

57 await onConnect(config)

58 } catch (err) {

59 setError(err.message)

60 setConnecting(false)

61 }

62 }

64 const presets = [

65 {

66 name: 'Local FTP Server',

67 host: 'localhost',

68 port: '21',

69 username: 'anonymous',

70 password: ''

71 },

72 {

73 name: 'Test FTP Server',

74 host: 'ftp.dlptest.com',

75 port: '21',

76 username: 'dlpuser',

77 password: 'rNrKYTX9g7z3RgJRmxWuGHbeu'

Medium

Secret Pattern

Package contains a possible secret pattern.

src/desktop/FTPConnectionDialog.jsxView on unpkg · L77

78 }

79 ]

81 const loadPreset = (preset) => {

82 setFormData(prev => ({

83 ...prev,

84 host: preset.host,

85 port: preset.port,

86 username: preset.username,

87 password: preset.password

88 }))

89 }

91 return (

92 <div className="ftp-connection-dialog">

93 <div className="ftp-dialog__header">

94 <h2>Connect to Remote Server</h2>

95 <button

96 className="ftp-dialog__close"

97 onClick={onCancel}

src/desktop/FontSettingsManager.jsView file

Lines 237-277javascript

237 this.listeners.delete(listener)

238 }

239

240 /**

241 * Notify all listeners of changes

242 */

243 notifyListeners() {

244 const settings = this.getAll()

dist/md/noteworthy.pdfView file

•path = dist/md/noteworthy.pdf kind = high_entropy_blob sizeBytes = 2191912 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/md/noteworthy.pdfView on unpkg

dist/index.modern.jsView file

•path = dist/index.modern.js kind = oversized_source_file sizeBytes = 7626012 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.modern.jsView on unpkg

src/widgets/login/Login.stories.jsxView file

Lines 363-407jsx

363 <ResetPasswordBox

364 userRequired={true}

365 oldPwdRequired={true}

366 onOK={(form) => alert(JSON.stringify(form))}

367 />

368

Source & flagged code

13 flagged · loading source

src/desktop/FTPConnectionDialog.jsxView file

77patternName = generic_password severity = medium line = 77 matchedText = password...beu'

Medium

Secret Pattern

Package contains a possible secret pattern.

src/desktop/FTPConnectionDialog.jsxView on unpkg · L77

src/desktop/FontSettingsManager.jsView file

257*/ L258: import(jsonString) { L259: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/desktop/FontSettingsManager.jsView on unpkg · L257

dist/md/noteworthy.pdfView file

•path = dist/md/noteworthy.pdf kind = high_entropy_blob sizeBytes = 2191912 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/md/noteworthy.pdfView on unpkg

dist/index.modern.jsView file

•path = dist/index.modern.js kind = oversized_source_file sizeBytes = 7626012 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.modern.jsView on unpkg

src/widgets/login/Login.stories.jsxView file

383patternName = generic_password severity = medium line = 383 matchedText = { pwd: '...' },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L383

384patternName = generic_password severity = medium line = 384 matchedText = { pwd: '...' },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L384

385patternName = generic_password severity = medium line = 385 matchedText = { pwd: '...' },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L385

386patternName = generic_password severity = medium line = 386 matchedText = { pwd: '...' },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L386

387patternName = generic_password severity = medium line = 387 matchedText = { pwd: '...' },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L387

594patternName = generic_password severity = medium line = 594 matchedText = 'admin@e...e },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L594

595patternName = generic_password severity = medium line = 595 matchedText = 'user@ex...e },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L595

596patternName = generic_password severity = medium line = 596 matchedText = '2fa@exa...e },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L596

597patternName = generic_password severity = medium line = 597 matchedText = 'locked@...e },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L597

Findings

2 High14 Medium5 Low

HighShips High Entropy Blobdist/md/noteworthy.pdf

HighOversized Source Filedist/index.modern.js

MediumSecret Patternsrc/desktop/FTPConnectionDialog.jsx

MediumDynamic Requiresrc/desktop/FontSettingsManager.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/widgets/login/Login.stories.jsx

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

src/desktop/FTPConnectionDialog.jsxView file

Lines 57-97jsx

57 await onConnect(config)

58 } catch (err) {

59 setError(err.message)

60 setConnecting(false)

61 }

62 }

64 const presets = [

65 {

66 name: 'Local FTP Server',

67 host: 'localhost',

68 port: '21',

69 username: 'anonymous',

70 password: ''

71 },

72 {

73 name: 'Test FTP Server',

74 host: 'ftp.dlptest.com',

75 port: '21',

76 username: 'dlpuser',

77 password: 'rNrKYTX9g7z3RgJRmxWuGHbeu'

Medium

Secret Pattern

Package contains a possible secret pattern.

src/desktop/FTPConnectionDialog.jsxView on unpkg · L77

78 }

79 ]

81 const loadPreset = (preset) => {

82 setFormData(prev => ({

83 ...prev,

84 host: preset.host,

85 port: preset.port,

86 username: preset.username,

87 password: preset.password

88 }))

89 }

91 return (

92 <div className="ftp-connection-dialog">

93 <div className="ftp-dialog__header">

94 <h2>Connect to Remote Server</h2>

95 <button

96 className="ftp-dialog__close"

97 onClick={onCancel}

src/desktop/FontSettingsManager.jsView file

Lines 237-277javascript

237 this.listeners.delete(listener)

238 }

239

240 /**

241 * Notify all listeners of changes

242 */

243 notifyListeners() {

244 const settings = this.getAll()

dist/md/noteworthy.pdfView file

•path = dist/md/noteworthy.pdf kind = high_entropy_blob sizeBytes = 2191912 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/md/noteworthy.pdfView on unpkg

dist/index.modern.jsView file

•path = dist/index.modern.js kind = oversized_source_file sizeBytes = 7626012 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.modern.jsView on unpkg

src/widgets/login/Login.stories.jsxView file

Lines 363-407jsx

363 <ResetPasswordBox

364 userRequired={true}

365 oldPwdRequired={true}

366 onOK={(form) => alert(JSON.stringify(form))}

367 />

368

Lines 574-614jsx

574

575/**

576 * Simulación de Login Realista

577 * Incluye todas las casuísticas de una aplicación web moderna

578 */

579export const RealWorldLoginSimulation = () => {

580 // Estados de la aplicación

582 const [loading, setLoading] = useState(false)

583 const [message, setMessage] = useState({ type: '', text: '' })

584 const [rememberMe, setRememberMe] = useState(false)

585 const [loginAttempts, setLoginAttempts] = useState(0)

586 const [lockoutTime, setLockoutTime] = useState(null)

587 const [verificationCode, setVerificationCode] = useState('')

588 const [pendingUser, setPendingUser] = useState(null)

589 const [forgotEmail, setForgotEmail] = useState('')

590 const [lockoutRemaining, setLockoutRemaining] = useState(0)

591

592 // Base de datos simulada de usuarios

593 const users = {

594 'admin@example.com': { password: 'Admin123!secure', name: 'Administrador', requires2FA: false, locked: false },

Medium

Secret Pattern

Hardcoded password in src/widgets/login/Login.stories.jsx

src/widgets/login/Login.stories.jsxView on unpkg · L594

595 'user@example.com': { password: 'User1234!secure', name: 'Usuario Normal', requires2FA: false, locked: false },

596 '2fa@example.com': { password: '2FA12345!secure', name: 'Usuario 2FA', requires2FA: true, locked: false },

597 'locked@example.com': { password: 'Locked123!secure', name: 'Usuario Bloqueado', requires2FA: false, locked: true },

598 }

599

600 // Verificar si está bloqueado por intentos

601 const isLockedOut = () => {

602 if (!lockoutTime) return false

603 const remaining = Math.ceil((lockoutTime - Date.now()) / 1000)

604 return remaining > 0

605 }

606

607 const getLockoutRemaining = () => {

608 if (!lockoutTime) return 0

609 return Math.max(0, Math.ceil((lockoutTime - Date.now()) / 1000))

610 }

611

612 // Simular login

613 const handleLogin = (email, password) => {

614 setMessage({ type: '', text: '' })