registry / @devfellowship/components / 2.0.0

@devfellowship/components@2.0.0

DFL Design System — UI components, hooks, utils and providers

AI Security Review

scanned 3h ago · by lpm-firewall-ai

DflRemote can disclose a supplied authentication token to broadly trusted DevFellowship subdomains. No install-time attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

Application renders DflRemote with a token/session and a matching iframe source.

Impact

A compromised or untrusted DevFellowship subdomain could obtain the application's supplied auth token.

Mechanism

Overbroad postMessage origin trust for token forwarding.

Rationale

Source inspection found a concrete token-forwarding trust-boundary flaw, but no malicious lifecycle execution, stealth persistence, or unconsented install mutation. Warn for the unresolved credential-exposure vulnerability.

Evidence

package.jsondist/index.cjsdist/cli.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/index.cjs DflRemote forwards authToken or Supabase access_token by postMessage.
Origin trust permits any https://*.devfellowship.com sender, not the configured iframe origin.
An allowed subdomain can signal DFL_READY and receive the supplied token when used as src.

@devfellowship/components@2.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code