registry / @digilogiclabs/saas-factory-ui / 2.5.0

@digilogiclabs/saas-factory-ui@2.5.0

Cross-platform UI component library built for both Next.js web applications and React Native/Expo mobile applications

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a React/React Native UI component library with runtime-only components, hooks, examples, and styling assets.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing or rendering exported UI components/hooks

Impact

No install-time execution, credential harvesting, persistence, or unsolicited exfiltration identified

Mechanism

component rendering, optional caller-configured fetch, local UI state/cache

Rationale

Static source inspection found no lifecycle execution, filesystem mutation, shell execution, agent control-surface writes, or credential exfiltration. Scanner hits map to normal UI-library features such as docs URLs, optional bug-report fetch, public env config helpers, localStorage cache/theme state, and demo asset URLs.

Evidence

package.jsonREADME.mddist/web/index.jsdist/native/index.jsdist/index.js

Network endpoints4

demo.supabase.cofonts.googleapis.com/css2?family=Outfit:wght@300;400;500;600;700;800;900&family=Space+Mono:wght@400;700&display=swapfonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Inter:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swapimages.unsplash.com/photo-1472099645785-5658abf4ff4e?w=32&h=32&fit=crop&crop=face

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks or bin entrypoints
package.json exports only dist web/native UI library entrypoints
No fs/child_process/os/vm/native-loader imports found in dist or README
dist/web/index.js fetch posts only user-submitted bug report data to a caller-provided endpoint
process.env reads are limited to public auth config keys and NODE_ENV checks
localStorage/NetInfo usage matches documented theme/cache/offline UI behavior

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 6.90 MB of source, external domains: demo.supabase.co, fonts.googleapis.com, images.unsplash.com, instagram.com, twitter.com, www.facebook.com, www.w3.org

Source & flagged code

10 flagged

dist/native/index.jsView file

Lines 8593-8635javascript

8593 style,

8594 titleStyle,

8595 inputStyle,

8596 buttonStyle,

8597 buttonTextStyle,

8598 linkStyle

8599}) => {

8600 const [email, setEmail] = (0, import_react23.useState)("");

8601 const [password, setPassword] = (0, import_react23.useState)("");

8602 const [errors, setErrors] = (0, import_react23.useState)(

8603 {}

8604 );

8605 const validateForm = () => {

8606 const newErrors = {};

8607 if (!email.trim()) {

8608 newErrors.email = "Email is required";

8609 } else if (!/\S+@\S+\.\S+/.test(email)) {

8610 newErrors.email = "Email is invalid";

8611 }

8612 if (!password.trim()) {

8613 newErrors.password = "Password is required";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/native/index.jsView on unpkg · L8613

8614 } else if (password.length < 6) {

8615 newErrors.password = "Password must be at least 6 characters";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8615

8616 }

8617 setErrors(newErrors);

8618 return Object.keys(newErrors).length === 0;

8619 };

8620 const handleSubmit = async () => {

8621 if (!validateForm() || loading) return;

8622 try {

8623 await onSubmit?.(email, password);

8624 } catch (error) {

8625 console.error("Login failed:", error);

8626 }

8627 };

8628 return /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: [styles24.container, style], children: [

8629 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(import_react_native24.Text, { style: [styles24.title, titleStyle], children: title }),

8630 /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: styles24.formContainer, children: [

8631 /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: styles24.inputContainer, children: [

8632 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(import_react_native24.Text, { style: styles24.label, children: emailLabel }),

8633 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(

8634 import_react_native24.TextInput,

8635 {

Lines 8802-8846javascript

8802 name: "",

8803 email: "",

8804 password: "",

8805 confirmPassword: ""

8806 });

8807 const [errors, setErrors] = (0, import_react24.useState)({});

8808 const

dist/native/index.mjsView file

Lines 8616-8658javascript

8616 style,

8617 titleStyle,

8618 inputStyle,

8619 buttonStyle,

8620 buttonTextStyle,

8621 linkStyle

8622}) => {

8623 const [email, setEmail] = useState26("");

8624

Source & flagged code

10 flagged · loading source

dist/native/index.jsView file

8613patternName = generic_password severity = medium line = 8613 matchedText = newError...ed";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/native/index.jsView on unpkg · L8613

8615patternName = generic_password severity = medium line = 8615 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8615

8822patternName = generic_password severity = medium line = 8822 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8822

8824patternName = generic_password severity = medium line = 8824 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8824

8826patternName = generic_password severity = medium line = 8826 matchedText = newError...er";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8826

dist/native/index.mjsView file

8636patternName = generic_password severity = medium line = 8636 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8636

8638patternName = generic_password severity = medium line = 8638 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8638

8853patternName = generic_password severity = medium line = 8853 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8853

8855patternName = generic_password severity = medium line = 8855 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8855

8857patternName = generic_password severity = medium line = 8857 matchedText = newError...er";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8857

Findings

12 Medium3 Low

MediumSecret Patterndist/native/index.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/native/index.js

MediumSecret Patterndist/native/index.mjs

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

dist/native/index.jsView file

Lines 8593-8635javascript

8593 style,

8594 titleStyle,

8595 inputStyle,

8596 buttonStyle,

8597 buttonTextStyle,

8598 linkStyle

8599}) => {

8600 const [email, setEmail] = (0, import_react23.useState)("");

8601 const [password, setPassword] = (0, import_react23.useState)("");

8602 const [errors, setErrors] = (0, import_react23.useState)(

8603 {}

8604 );

8605 const validateForm = () => {

8606 const newErrors = {};

8607 if (!email.trim()) {

8608 newErrors.email = "Email is required";

8609 } else if (!/\S+@\S+\.\S+/.test(email)) {

8610 newErrors.email = "Email is invalid";

8611 }

8612 if (!password.trim()) {

8613 newErrors.password = "Password is required";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/native/index.jsView on unpkg · L8613

8614 } else if (password.length < 6) {

8615 newErrors.password = "Password must be at least 6 characters";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8615

8616 }

8617 setErrors(newErrors);

8618 return Object.keys(newErrors).length === 0;

8619 };

8620 const handleSubmit = async () => {

8621 if (!validateForm() || loading) return;

8622 try {

8623 await onSubmit?.(email, password);

8624 } catch (error) {

8625 console.error("Login failed:", error);

8626 }

8627 };

8628 return /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: [styles24.container, style], children: [

8629 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(import_react_native24.Text, { style: [styles24.title, titleStyle], children: title }),

8630 /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: styles24.formContainer, children: [

8631 /* @__PURE__ */ (0, import_jsx_runtime36.jsxs)(import_react_native24.View, { style: styles24.inputContainer, children: [

8632 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(import_react_native24.Text, { style: styles24.label, children: emailLabel }),

8633 /* @__PURE__ */ (0, import_jsx_runtime36.jsx)(

8634 import_react_native24.TextInput,

8635 {

Lines 8802-8846javascript

8802 name: "",

8803 email: "",

8804 password: "",

8805 confirmPassword: ""

8806 });

8807 const [errors, setErrors] = (0, import_react24.useState)({});

8808 const

dist/native/index.mjsView file

Lines 8616-8658javascript

8616 style,

8617 titleStyle,

8618 inputStyle,

8619 buttonStyle,

8620 buttonTextStyle,

8621 linkStyle

8622}) => {

8623 const [email, setEmail] = useState26("");

8624