registry / @digilogiclabs/saas-factory-ui / 2.6.0

@digilogiclabs/saas-factory-ui@2.6.0

Cross-platform UI component library built for both Next.js web applications and React Native/Expo mobile applications

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Network and storage primitives are package-aligned UI features triggered by consuming app components or user actions.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime use of exported React/React Native UI components

Impact

No install-time execution, credential harvesting, persistence, or unauthorized file/network behavior identified

Mechanism

UI components, local cache/theme storage, optional caller-provided feedback POST

Rationale

Static inspection shows a bundled cross-platform UI component library with benign runtime browser/native APIs and no lifecycle hooks or concrete exfiltration/RCE/persistence chain. Scanner signals map to expected UI behavior such as localStorage, caller-supplied fetch endpoints, public env config, demo URLs, and password form components.

Evidence

package.jsondist/web/index.jsdist/native/index.jsdist/index.jsREADME.md

Network endpoints8

github.com/DigiLogicLabs/dll-platform/tree/main/packages/saas-factory-ui#readmegithub.com/DigiLogicLabs/dll-platform.gitregistry.npmjs.org/demo.supabase.cofonts.googleapis.com/images.unsplash.com/twitter.com/www.facebook.com/

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks and only build/test/lint/release scripts.
Entrypoints are dist/web/index.js, dist/web/index.mjs, and dist/native/index.js for a React/React Native UI library.
No fs, child_process, shell execution, eval/Function, native binary loading, or project-file mutation found in distributed JS.
fetch usage in dist/web/index.js posts a user-submitted bug report to caller-provided endpoint, not a hardcoded exfiltration host.
process.env reads in dist/web/index.js and dist/native/index.js are limited to public app config/auth provider detection and NODE_ENV devtools checks.
Secret-pattern hits are UI password fields/validators, public demo Supabase URL, and type token wording, not embedded credentials.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 6.91 MB of source, external domains: demo.supabase.co, fonts.googleapis.com, images.unsplash.com, instagram.com, twitter.com, www.facebook.com, www.w3.org

Source & flagged code

10 flagged

dist/native/index.jsView file

Lines 8593-8635javascript

8593 style,

8594 titleStyle,

8595 inputStyle,

8596 buttonStyle,

8597 buttonTextStyle,

8598 linkStyle

8599}) => {

8600 const [email, setEmail] = (0, import_react23.useState)("");

8601 const [password, setPassword] = (0, import_react23.useState)("");

8602 const [errors, setErrors] = (0, import_react23.useState)(

8603 {}

8604 );

8605 const validateForm = () => {

8606 const newErrors = {};

8607 if (!email.trim()) {

8608 newErrors.email = "Email is required";

8609 } else if (!/\S+@\S+\.\S+/.test(email)) {

8610 newErrors.email = "Email is invalid";

8611 }

8612 if (!password.trim()) {

8613 newErrors.password = "Password is required";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/native/index.jsView on unpkg · L8613

8614 } else if (password.length < 6) {

8615 newErrors.password = "Password must be at least 6 characters";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8615

8616 }

8617 setErrors(newErrors);

8618 return Object.keys(newErrors).length === 0;

8619 };

8620 const handleSubmit = async () => {

8621 if (!validateForm() || loading) return;

8622 try {

8623 await onSubmit?.(email, password);

8624 } catch (error) {

8625 console.error("Login failed:", error);

8626 }

8627 };

8628 return /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: [styles24.container, style], children: [

8629 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(import_react_native24.Text, { style: [styles24.title, titleStyle], children: title }),

8630 /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: styles24.formContainer, children: [

8631 /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: styles24.inputContainer, children: [

8632 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(import_react_native24.Text, { style: styles24.label, children: emailLabel }),

8633 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(

8634 import_react_native24.TextInput,

8635 {

Lines 8802-8846javascript

8802 name: "",

8803 email: "",

8804 password: "",

8805 confirmPassword: ""

8806 });

8807 const [errors, setErrors] = (0, import_react24.useState)({});

8808 const

dist/native/index.mjsView file

Lines 8616-8658javascript

8616 style,

8617 titleStyle,

8618 inputStyle,

8619 buttonStyle,

8620 buttonTextStyle,

8621 linkStyle

8622}) => {

8623 const [email, setEmail] = useState26("");

8624

Source & flagged code

10 flagged · loading source

dist/native/index.jsView file

8613patternName = generic_password severity = medium line = 8613 matchedText = newError...ed";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/native/index.jsView on unpkg · L8613

8615patternName = generic_password severity = medium line = 8615 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8615

8822patternName = generic_password severity = medium line = 8822 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8822

8824patternName = generic_password severity = medium line = 8824 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8824

8826patternName = generic_password severity = medium line = 8826 matchedText = newError...er";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8826

dist/native/index.mjsView file

8636patternName = generic_password severity = medium line = 8636 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8636

8638patternName = generic_password severity = medium line = 8638 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8638

8853patternName = generic_password severity = medium line = 8853 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8853

8855patternName = generic_password severity = medium line = 8855 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8855

8857patternName = generic_password severity = medium line = 8857 matchedText = newError...er";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8857

Findings

12 Medium3 Low

MediumSecret Patterndist/native/index.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/native/index.js

MediumSecret Patterndist/native/index.mjs

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

dist/native/index.jsView file

Lines 8593-8635javascript

8593 style,

8594 titleStyle,

8595 inputStyle,

8596 buttonStyle,

8597 buttonTextStyle,

8598 linkStyle

8599}) => {

8600 const [email, setEmail] = (0, import_react23.useState)("");

8601 const [password, setPassword] = (0, import_react23.useState)("");

8602 const [errors, setErrors] = (0, import_react23.useState)(

8603 {}

8604 );

8605 const validateForm = () => {

8606 const newErrors = {};

8607 if (!email.trim()) {

8608 newErrors.email = "Email is required";

8609 } else if (!/\S+@\S+\.\S+/.test(email)) {

8610 newErrors.email = "Email is invalid";

8611 }

8612 if (!password.trim()) {

8613 newErrors.password = "Password is required";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/native/index.jsView on unpkg · L8613

8614 } else if (password.length < 6) {

8615 newErrors.password = "Password must be at least 6 characters";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8615

8616 }

8617 setErrors(newErrors);

8618 return Object.keys(newErrors).length === 0;

8619 };

8620 const handleSubmit = async () => {

8621 if (!validateForm() || loading) return;

8622 try {

8623 await onSubmit?.(email, password);

8624 } catch (error) {

8625 console.error("Login failed:", error);

8626 }

8627 };

8628 return /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: [styles24.container, style], children: [

8629 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(import_react_native24.Text, { style: [styles24.title, titleStyle], children: title }),

8630 /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: styles24.formContainer, children: [

8631 /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: styles24.inputContainer, children: [

8632 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(import_react_native24.Text, { style: styles24.label, children: emailLabel }),

8633 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(

8634 import_react_native24.TextInput,

8635 {

Lines 8802-8846javascript

8802 name: "",

8803 email: "",

8804 password: "",

8805 confirmPassword: ""

8806 });

8807 const [errors, setErrors] = (0, import_react24.useState)({});

8808 const

dist/native/index.mjsView file

Lines 8616-8658javascript

8616 style,

8617 titleStyle,

8618 inputStyle,

8619 buttonStyle,

8620 buttonTextStyle,

8621 linkStyle

8622}) => {

8623 const [email, setEmail] = useState26("");

8624