registry / @digilogiclabs/saas-factory-ui / 2.6.0

@digilogiclabs/saas-factory-ui@2.6.0

Cross-platform UI component library built for both Next.js web applications and React Native/Expo mobile applications

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Network and storage primitives are package-aligned UI features triggered by consuming app components or user actions.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime use of exported React/React Native UI components

Impact

No install-time execution, credential harvesting, persistence, or unauthorized file/network behavior identified

Mechanism

UI components, local cache/theme storage, optional caller-provided feedback POST

Rationale

Static inspection shows a bundled cross-platform UI component library with benign runtime browser/native APIs and no lifecycle hooks or concrete exfiltration/RCE/persistence chain. Scanner signals map to expected UI behavior such as localStorage, caller-supplied fetch endpoints, public env config, demo URLs, and password form components.

Evidence

package.jsondist/web/index.jsdist/native/index.jsdist/index.jsREADME.md

Network endpoints8

github.com/DigiLogicLabs/dll-platform/tree/main/packages/saas-factory-ui#readmegithub.com/DigiLogicLabs/dll-platform.gitregistry.npmjs.org/demo.supabase.cofonts.googleapis.com/images.unsplash.com/twitter.com/www.facebook.com/

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks and only build/test/lint/release scripts.
Entrypoints are dist/web/index.js, dist/web/index.mjs, and dist/native/index.js for a React/React Native UI library.
No fs, child_process, shell execution, eval/Function, native binary loading, or project-file mutation found in distributed JS.
fetch usage in dist/web/index.js posts a user-submitted bug report to caller-provided endpoint, not a hardcoded exfiltration host.
process.env reads in dist/web/index.js and dist/native/index.js are limited to public app config/auth provider detection and NODE_ENV devtools checks.
Secret-pattern hits are UI password fields/validators, public demo Supabase URL, and type token wording, not embedded credentials.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 6.91 MB of source, external domains: demo.supabase.co, fonts.googleapis.com, images.unsplash.com, instagram.com, twitter.com, www.facebook.com, www.w3.org

Source & flagged code

10 flagged

dist/native/index.jsView file

Lines 8593-8635javascript

8593 style,

8594 titleStyle,

8595 inputStyle,

8596 buttonStyle,

8597 buttonTextStyle,

8598 linkStyle

8599}) => {

8600 const [email, setEmail] = (

Source & flagged code

10 flagged · loading source

dist/native/index.jsView file

8613patternName = generic_password severity = medium line = 8613 matchedText = newError...ed";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/native/index.jsView on unpkg · L8613

8615patternName = generic_password severity = medium line = 8615 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8615

8822patternName = generic_password severity = medium line = 8822 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8822

8824patternName = generic_password severity = medium line = 8824 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8824

8826patternName = generic_password severity = medium line = 8826 matchedText = newError...er";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8826

dist/native/index.mjsView file

8636patternName = generic_password severity = medium line = 8636 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8636

8638patternName = generic_password severity = medium line = 8638 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8638

8853patternName = generic_password severity = medium line = 8853 matchedText = newError...ed";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8853

8855patternName = generic_password severity = medium line = 8855 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8855

8857patternName = generic_password severity = medium line = 8857 matchedText = newError...er";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8857

Findings

12 Medium3 Low

MediumSecret Patterndist/native/index.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/native/index.js

MediumSecret Patterndist/native/index.mjs

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Lines 8802-8846javascript

8802 name: "",

8803 email: "",

8804 password: "",

8805 confirmPassword: ""

8806 });

8807 const [errors, setErrors] = (0, import_react24.useState)({});

8808 const updateField = (field, value) => {

8809 setFormData((prev) => ({ ...prev, [field]: value }));

8810 };

8811 const validateForm = () => {

8812 const newErrors = {};

8813 if (requireName && !formData.name.trim()) {

8814 newErrors.name = "Name is required";

8815 }

8816 if (!formData.email.trim()) {

8817 newErrors.email = "Email is required";

8818 } else if (!/\S+@\S+\.\S+/.test(formData.email)) {

8819 newErrors.email = "Email is invalid";

8820 }

8821 if (!formData.password.trim()) {

8822 newErrors.password = "Password is required";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8822

8823 } else if (formData.password.length < 8) {

8824 newErrors.password = "Password must be at least 8 characters";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8824

8825 } else if (!/(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/.test(formData.password)) {

8826 newErrors.password = "Password must contain uppercase, lowercase, and number";

Medium

Secret Pattern

Hardcoded password in dist/native/index.js

dist/native/index.jsView on unpkg · L8826

8827 }

8828 if (!formData.confirmPassword.trim()) {

8829 newErrors.confirmPassword = "Please confirm your password";

8830 } else if (formData.password !== formData.confirmPassword) {

8831 newErrors.confirmPassword = "Passwords do not match";

8832 }

8833 setErrors(newErrors);

8834 return Object.keys(newErrors).length === 0;

8835 };

8836 const handleSubmit = async () => {

8837 if (!validateForm() || loading) return;

8838 try {

8839 await onSubmit?.(formData);

8840 } catch (error) {

8841 console.error("Signup failed:", error);

8842 }

8843 };

8844 return /* @__PURE__ */ (0, import_jsx_runtime37.jsxs)(

8845 import_react_native25.ScrollView,

8846 {

dist/native/index.mjsView file

Lines 8616-8658javascript

8616 style,

8617 titleStyle,

8618 inputStyle,

8619 buttonStyle,

8620 buttonTextStyle,

8621 linkStyle

8622}) => {

8623 const [email, setEmail] = useState26("");

8624 const [password, setPassword] = useState26("");

8625 const [errors, setErrors] = useState26(

8626 {}

8627 );

8628 const validateForm = () => {

8629 const newErrors = {};

8630 if (!email.trim()) {

8631 newErrors.email = "Email is required";

8632 } else if (!/\S+@\S+\.\S+/.test(email)) {

8633 newErrors.email = "Email is invalid";

8634 }

8635 if (!password.trim()) {

8636 newErrors.password = "Password is required";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8636

8637 } else if (password.length < 6) {

8638 newErrors.password = "Password must be at least 6 characters";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8638

8639 }

8640 setErrors(newErrors);

8641 return Object.keys(newErrors).length === 0;

8642 };

8643 const handleSubmit = async () => {

8644 if (!validateForm() || loading) return;

8645 try {

8646 await onSubmit?.(email, password);

8647 } catch (error) {

8648 console.error("Login failed:", error);

8649 }

8650 };

8651 return /* @__PURE__ */ jsxs30(View32, { style: [styles24.container, style], children: [

8652 /* @__PURE__ */ jsx36(Text24, { style: [styles24.title, titleStyle], children: title }),

8653 /* @__PURE__ */ jsxs30(View32, { style: styles24.formContainer, children: [

8654 /* @__PURE__ */ jsxs30(View32, { style: styles24.inputContainer, children: [

8655 /* @__PURE__ */ jsx36(Text24, { style: styles24.label, children: emailLabel }),

8656 /* @__PURE__ */ jsx36(

8657 TextInput3,

8658 {

Lines 8833-8873javascript

8833 name: "",

8834 email: "",

8835 password: "",

8836 confirmPassword: ""

8837 });

8838 const [errors, setErrors] = useState27({});

8839 const

8855patternName = generic_password severity = medium line = 8855 matchedText = newError...rs";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8855

8857patternName = generic_password severity = medium line = 8857 matchedText = newError...er";

Medium

Secret Pattern

Hardcoded password in dist/native/index.mjs

dist/native/index.mjsView on unpkg · L8857