technical-drawing
Warn
Audited by Socket on Oct 13, 2026
1 alert found:
AnomalyAnomalyassets/projection.js
LOWAnomalyLOW
assets/projection.js
This is a geometry-to-SVG renderer, with no evident malware behavior. The unescaped line.role value creates an injection risk when caller-controlled parts are rendered into an active document. Validate roles against an allowlist or escape them before interpolation; consider input-size limits for resource use.
Confidence: 98%Severity: 56%
Audit Metadata