registry / @antimatter-audio/antimatter-ui / 16.5.6

@antimatter-audio/antimatter-ui@16.5.6

React UI component library for Antimatter Audio.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Runtime code can create visualization workers and fetch JUCE-local JSON resources; embedded workers load D3 from its public CDN.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer imports/renders affected React visualization components at runtime.

Impact

Package-aligned UI behavior; no confirmed credential theft, exfiltration, persistence, or install-time execution.

Mechanism

React UI components with JUCE backend integration and Base64-bundled visualization workers

Rationale

Static inspection found a UI library with package-aligned JUCE backend calls and visualization workers; the Base64 worker/CDN D3 signal is explainable by bundled chart workers, not a payload or exfiltration path. With no lifecycle hooks, harvesting, shelling out, persistence, or malicious endpoint, this should be marked clean.

Evidence

package.jsonREADME.mddist/index.jsdist/index.js.map

Network endpoints1

d3js.org/d3.v7.min.js

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/index.js contains Base64-embedded web workers that call importScripts('https://d3js.org/d3.v7.min.js').
dist/index.js uses Worker(...,{eval:true}) in Node-style worker_threads path for those embedded worker bodies.
dist/index.js fetches JUCE backend resource JSON for UI event data via Juce.getBackendResourceAddress(...).

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks and main is dist/index.js.
dist/index.js exports React/JUCE UI components; suspicious primitives are used for charts, meters, LFO visualization, and backend UI state.
No credential/env/cookie/localStorage harvesting, shell execution, persistence, destructive behavior, or external exfiltration code found.
Network use is limited to d3js.org worker library loading and JUCE backend resource fetches; no attacker-controlled collection endpoint found.
README.md describes a JUCE React UI component library matching the inspected implementation.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 359 KB of source, external domains: www.w3.org

Source & flagged code

1 flagged

dist/index.jsView file

Lines 501-541javascript

501 const numericWidth = getNumericValue(width);

502 const numericHeight = getNumericValue(height);

503 const numericBorderWidth = getNumericValue(borderWidth);

504 const stringWidth = getStringSizeValue(width);

505 const stringHeight = getStringSizeValue(height);

506 return jsx("svg", {

507 width: stringWidth,

508 height: stringHeight,

509 style: {

510 position: 'absolute',

511 zIndex: -1,

512 top: 0,

513 bottom: 0,

514 right: 0,

515 left: 0,

516 filter: generateDropShadowFilterString(outerGlowColors, outerGlowRadius),

517 ...style

518 },

519 ...rest,

520 vectorEffect: "non-scaling-stroke",

521 shapeRendering: "crispEdges",

522 xmlns: "http://www.w3.org/2000/svg",

523 children: jsx("polygon", {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L521

524 points: `${cornerBevel[0] + numericBorderWidth},${numericBorderWidth}

525 ${numericWidth - cornerBevel[1] - numericBorderWidth},${numericBorderWidth}

526 ${numericWidth - numericBorderWidth},${cornerBevel[1] + numericBorderWidth}

527 ${numericWidth - numericBorderWidth},${numericHeight - cornerBevel[2] - numericBorderWidth}

528 ${numericWidth - cornerBevel[2] - numericBorderWidth},${numericHeight - numericBorderWidth}

529 ${cornerBevel[3] + numericBorderWidth},${numericHeight - numericBorderWidth}

530 ${numericBorderWidth}, ${numericHeight - cornerBevel[3] - numericBorderWidth}

531 ${numericBorderWidth}, ${cornerBevel[0] + numericBorderWidth}`,

532 onMouseEnter: ()=>setComponentIsHovered(true),

533 onMouseLeave: ()=>setComponentIsHovered(false),

534 fill: componentIsHovered ? highlightFillColor : fillColor,

535 stroke: borderColor,

536 vectorEffect: "non-scaling-stroke",

537 shapeRendering: "crispEdges",

538 strokeWidth: numericBorderWidth

539 })

540 });

541}

Source & flagged code

1 flagged · loading source

dist/index.jsView file

521shapeRendering: "crispEdges", L522: xmlns: "http://www.w3.org/2000/svg", L523: children: jsx("polygon", { ... L3396: if (eventId) { L3397: fetch(Juce.getBackendResourceAddress(`${eventId}.json`)).then((response)=>response.text()).then((text)=>{ L3398: const data = JSON.parse(text); ... L4702: fillGradient: fillGradient, L4703: data: data, L4704: xScale: xScale,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L521

Findings

1 High1 Medium3 Low

HighBase64 Obscured Urldist/index.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings