@eifi1/ui-kit
App-agnostic shared design system: domain-free React components, theme and tokens.
This report shows the evidence for @eifi1/ui-kit@0.56.0. 1 of 54 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 1h ago · by lpm-firewall-aiThe runtime signals inspected do not establish an attack, and the flagged secret pattern is ordinary UI copy. However, package metadata explicitly addresses a prior finding and asserts a safe conclusion, which meets the reviewer-manipulation rule.
Static reason
One or more suspicious static signals were detected.
Trigger
A reviewer or automated review system inspects package.json.
Impact
Could mislead a reviewer into dismissing a finding or granting a clean verdict.
Mechanism
The `sideEffects` value discusses a prior finding and asserts the package is safe.
Attack narrative
When package metadata is reviewed, its `sideEffects` value discusses a prior finding and asserts the code is safe, attempting to influence the reviewer’s verdict.
AI rationale
The runtime signals inspected do not establish an attack, and the flagged secret pattern is ordinary UI copy. However, package metadata explicitly addresses a prior finding and asserts a safe conclusion, which meets the reviewer-manipulation rule.
Evidence
package.json
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- The `package.json` `sideEffects` value refers to a prior “finding” and asserts “so this is safe,” attempting to shape a reviewer’s assessment.
Evidence against
- The flagged registration-form text is ordinary guidance about tagged email addresses, not a credential or secret.
- The manifest’s lifecycle scripts are a build step and `husky || true`; no install-time data collection was identified.
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
37 flaggeddist/auth/register-form-labels.jsView file
11patternName = generic_password
severity = medium
line = 11
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/auth/register-form-labels.jsView on unpkg · L11dist/auth/sign-in-form-labels.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
Secret Pattern
Hardcoded password in dist/auth/sign-in-form-labels.js
dist/auth/sign-in-form-labels.jsView on unpkg · L5dist/account/email-change-setting-labels.jsView file
7patternName = generic_password
severity = medium
line = 7
Medium
Secret Pattern
Hardcoded password in dist/account/email-change-setting-labels.js
dist/account/email-change-setting-labels.jsView on unpkg · L7dist/account/account-settings-labels.jsView file
36patternName = generic_password
severity = medium
line = 36
Medium
Secret Pattern
Hardcoded password in dist/account/account-settings-labels.js
dist/account/account-settings-labels.jsView on unpkg · L36dist/i18n/locales/zh.jsView file
234patternName = generic_password
severity = medium
line = 234
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L234480patternName = generic_password
severity = medium
line = 480
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L480849patternName = generic_password
severity = medium
line = 849
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L849973patternName = generic_password
severity = medium
line = 973
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L9731016patternName = generic_password
severity = medium
line = 1016
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L10161122patternName = generic_password
severity = medium
line = 1122
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L1122dist/i18n/locales/fr.jsView file
239patternName = generic_password
severity = medium
line = 239
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L239489patternName = generic_password
severity = medium
line = 489
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L489863patternName = generic_password
severity = medium
line = 863
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L863988patternName = generic_password
severity = medium
line = 988
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L9881034patternName = generic_password
severity = medium
line = 1034
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L10341144patternName = generic_password
severity = medium
line = 1144
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L1144dist/i18n/locales/hu.jsView file
236patternName = generic_password
severity = medium
line = 236
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L236484patternName = generic_password
severity = medium
line = 484
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L484862patternName = generic_password
severity = medium
line = 862
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L862990patternName = generic_password
severity = medium
line = 990
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L9901034patternName = generic_password
severity = medium
line = 1034
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L10341141patternName = generic_password
severity = medium
line = 1141
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L1141dist/i18n/locales/it.jsView file
235patternName = generic_password
severity = medium
line = 235
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/it.js
dist/i18n/locales/it.jsView on unpkg · L235858patternName = generic_password
severity = medium
line = 858
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/it.js
dist/i18n/locales/it.jsView on unpkg · L8581138patternName = generic_password
severity = medium
line = 1138
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/it.js
dist/i18n/locales/it.jsView on unpkg · L1138dist/i18n/locales/es.jsView file
235patternName = generic_password
severity = medium
line = 235
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L235482patternName = generic_password
severity = medium
line = 482
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L482852patternName = generic_password
severity = medium
line = 852
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L852974patternName = generic_password
severity = medium
line = 974
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L9741017patternName = generic_password
severity = medium
line = 1017
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L10171123patternName = generic_password
severity = medium
line = 1123
Medium
Secret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L1123dist/i18n/german.jsView file
240patternName = generic_password
severity = medium
line = 240
Medium
491patternName = generic_password
severity = medium
line = 491
Medium
869patternName = generic_password
severity = medium
line = 869
Medium
989patternName = generic_password
severity = medium
line = 989
Medium
1034patternName = generic_password
severity = medium
line = 1034
Medium
1146patternName = generic_password
severity = medium
line = 1146
Medium
Findings
38 Medium6 Low
MediumSecret Patterndist/auth/register-form-labels.js
MediumNetwork
MediumSecret Patterndist/auth/sign-in-form-labels.js
MediumSecret Patterndist/account/email-change-setting-labels.js
MediumSecret Patterndist/account/account-settings-labels.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/it.js
MediumSecret Patterndist/i18n/locales/it.js
MediumSecret Patterndist/i18n/locales/it.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @eifi1/ui-kit@0.56.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @eifi1/ui-kit@0.56.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
54 known versions0.56.0latestshownMaliciousMalwareBlockPublishedNov 5, 2026, 8:22 AM0.54.0Unknown—AllowUnder ReviewNov 4, 2026, 6:54 AM0.53.0Unknown—AllowUnder ReviewNov 2, 2026, 9:23 PM0.52.0Unknown—AllowUnder ReviewOct 31, 2026, 3:28 PM0.51.7Unknown—AllowUnder ReviewOct 31, 2026, 7:36 AM0.51.6Unknown—AllowUnder ReviewOct 30, 2026, 9:01 AM0.51.5Unknown—AllowUnder ReviewOct 29, 2026, 10:52 PM0.51.3Unknown—AllowUnder ReviewOct 29, 2026, 4:53 PM0.51.1Unknown—AllowUnder ReviewOct 26, 2026, 11:43 PM0.51.0Unknown—AllowUnder ReviewOct 26, 2026, 12:04 PM0.50.1Unknown—AllowUnder ReviewOct 23, 2026, 12:49 PM0.49.0Unknown—AllowUnder ReviewOct 22, 2026, 7:57 PM0.48.2Unknown—AllowUnder ReviewOct 22, 2026, 11:35 AM0.48.1Unknown—AllowUnder ReviewOct 22, 2026, 6:22 AM0.48.0Unknown—AllowUnder ReviewOct 22, 2026, 4:39 AM0.47.0Unknown—AllowUnder ReviewOct 21, 2026, 8:16 AM0.45.0Unknown—AllowUnder ReviewOct 19, 2026, 2:44 PM0.44.0Unknown—AllowUnder ReviewOct 17, 2026, 9:15 PM0.43.0Unknown—AllowUnder ReviewOct 17, 2026, 3:38 PM0.42.0Unknown—AllowUnder ReviewOct 17, 2026, 12:12 PM0.41.0Unknown—AllowUnder ReviewOct 17, 2026, 7:21 AM0.40.1Unknown—AllowUnder ReviewOct 17, 2026, 5:24 AM0.40.0Unknown—AllowUnder ReviewOct 16, 2026, 6:44 PM0.39.1Unknown—AllowUnder ReviewOct 15, 2026, 8:11 AM0.39.0Unknown—AllowUnder ReviewOct 15, 2026, 6:05 AM0.38.1Unknown—AllowUnder ReviewOct 14, 2026, 5:58 PM0.38.0Unknown—AllowUnder ReviewOct 14, 2026, 2:53 PM0.37.0Unknown—AllowUnder ReviewOct 14, 2026, 9:53 AM0.36.0Unknown—AllowUnder ReviewOct 13, 2026, 6:22 PM0.35.0Unknown—AllowUnder ReviewOct 13, 2026, 1:59 PM0.34.0Unknown—AllowUnder ReviewOct 13, 2026, 8:14 AM0.33.1Unknown—AllowUnder ReviewOct 12, 2026, 2:12 PM0.33.0Unknown—AllowUnder ReviewOct 9, 2026, 11:04 PM0.32.2Unknown—AllowUnder ReviewOct 9, 2026, 11:33 AM0.32.1Unknown—AllowUnder ReviewOct 9, 2026, 6:40 AM0.32.0Unknown—AllowUnder ReviewOct 8, 2026, 2:14 PM0.31.1Unknown—AllowUnder ReviewOct 8, 2026, 6:45 AM0.29.0Unknown—AllowUnder ReviewOct 6, 2026, 10:48 PM0.28.1Unknown—AllowUnder ReviewOct 6, 2026, 7:15 AM0.26.0Unknown—AllowUnder ReviewOct 3, 2026, 7:31 PM0.22.0Unknown—AllowUnder ReviewOct 2, 2026, 9:40 PM0.16.1Unknown—AllowUnder ReviewOct 1, 2026, 5:49 PM0.15.5Unknown—AllowUnder ReviewOct 1, 2026, 11:45 AM0.15.3Unknown—AllowUnder ReviewSep 28, 2026, 8:50 PM0.15.2Unknown—AllowUnder ReviewSep 28, 2026, 6:31 AM0.15.1Unknown—AllowUnder ReviewSep 27, 2026, 8:59 PM0.14.2Unknown—AllowUnder ReviewSep 27, 2026, 5:13 PM0.14.1Unknown—AllowUnder ReviewSep 27, 2026, 2:56 PM0.14.0Unknown—AllowUnder ReviewSep 27, 2026, 1:07 PM0.12.0Unknown—AllowUnder ReviewSep 26, 2026, 8:52 PM0.10.0Unknown—AllowUnder ReviewSep 26, 2026, 2:11 PM0.9.0Unknown—AllowUnder ReviewSep 25, 2026, 10:05 PM0.8.0Unknown—AllowUnder ReviewSep 25, 2026, 10:19 AM0.4.1Unknown—AllowUnder ReviewSep 21, 2026, 9:46 PM