registry / @devfellowship/components / 2.0.0

@devfellowship/components@2.0.0

DFL Design System — UI components, hooks, utils and providers

AI Security Review

scanned 3h ago · by lpm-firewall-ai

DflRemote can disclose a supplied authentication token to broadly trusted DevFellowship subdomains. No install-time attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

Application renders DflRemote with a token/session and a matching iframe source.

Impact

A compromised or untrusted DevFellowship subdomain could obtain the application's supplied auth token.

Mechanism

Overbroad postMessage origin trust for token forwarding.

Rationale

Source inspection found a concrete token-forwarding trust-boundary flaw, but no malicious lifecycle execution, stealth persistence, or unconsented install mutation. Warn for the unresolved credential-exposure vulnerability.

Evidence

package.jsondist/index.cjsdist/cli.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/index.cjs DflRemote forwards authToken or Supabase access_token by postMessage.
Origin trust permits any https://*.devfellowship.com sender, not the configured iframe origin.
An allowed subdomain can signal DFL_READY and receive the supplied token when used as src.

dist/cli.js fetches registry content and writes files only through explicit add command.

Evidence against

package.json has no preinstall/install/postinstall hook.
Library entrypoints contain UI components; no import-time filesystem, shell, or network execution.
CLI filesystem writes, schema fetches, and git command run only under named user commands.

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 9 file(s), 719 KB of source, external domains: devfellowship.com, devfellowship.s3.sa-east-1.amazonaws.com, github.com, raw.githubusercontent.com

Source & flagged code

2 flagged

dist/index.cjsView file

•Published source reference

Medium

Ai Review Evidence

dist/index.cjs DflRemote forwards authToken or Supabase access_token by postMessage.

dist/index.cjsView on unpkg

dist/cli.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/cli.js fetches registry content and writes files only through explicit add command.

dist/cli.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/index.cjsView file

•Published source reference

Medium

Ai Review Evidence

dist/index.cjs DflRemote forwards authToken or Supabase access_token by postMessage.

dist/index.cjsView on unpkg

dist/cli.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/cli.js fetches registry content and writes files only through explicit add command.

dist/cli.jsView on unpkg

Findings

5 Medium6 Low

MediumNetwork

MediumAi Review Evidencedist/index.cjs

MediumAi Review Evidence

MediumAi Review Evidencedist/cli.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LPM CLI

Behavioral surface

ChildProcessFilesystemNetworkShellHighEntropyStringsUrlStringsNoLicense

Source & flagged code

2 flagged

dist/index.cjsView file

•Published source reference

Medium

Ai Review Evidence

dist/index.cjs DflRemote forwards authToken or Supabase access_token by postMessage.

dist/index.cjsView on unpkg

dist/cli.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/cli.js fetches registry content and writes files only through explicit add command.

dist/cli.jsView on unpkg