Loading npm security reports…
Allowed — no malicious behavior detected
No malicious behavior detected. 50 low-signal pattern(s) reviewed.
@eifi1/ui-kit@0.31.1
⚠ Under reviewApp-agnostic shared design system: domain-free React components, theme and tokens.
Static Scan Results
scanned 28d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 50 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
Supply chainHighEntropyStringsTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 580 file(s), 6.64 MB of source, external domains: kit.invalid, www.w3.org
Source & flagged code
44 flagged21patternName = generic_password
severity = medium
line = 21
MediumSecret Pattern
Package contains a possible secret pattern.
dist/auth/sign-in-form.jsView on unpkg · L21 src/i18n/kit-labels.tsx#virtual:normalized:round1View file •stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/i18n/kit-labels.tsx#virtual:normalized:round1View on unpkg Findings
1 High44 Medium5 Low
HighSemantic Analysis Limitedsrc/i18n/kit-labels.tsx#virtual:normalized:round1
MediumSecret Patterndist/auth/sign-in-form.js
MediumNetwork
MediumSecret Patterndist/auth/register-form.js
MediumSecret Patterndist/account/email-change-setting.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/fr.js
Affected versions and remediation
This report applies to @eifi1/ui-kit@0.31.1.
See all versions of @eifi1/ui-kit for other recorded verdicts.
- Review the evidence and your use of @eifi1/ui-kit@0.31.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
25patternName = generic_password
severity = medium
line = 25
MediumSecret Pattern
Hardcoded password in dist/auth/register-form.js
dist/auth/register-form.jsView on unpkg · L25 dist/account/email-change-setting.jsView file 19patternName = generic_password
severity = medium
line = 19
MediumSecret Pattern
Hardcoded password in dist/account/email-change-setting.js
dist/account/email-change-setting.jsView on unpkg · L19 163patternName = generic_password
severity = medium
line = 163
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L163 405patternName = generic_password
severity = medium
line = 405
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L405 708patternName = generic_password
severity = medium
line = 708
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L708 822patternName = generic_password
severity = medium
line = 822
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L822 865patternName = generic_password
severity = medium
line = 865
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L865 971patternName = generic_password
severity = medium
line = 971
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/zh.js
dist/i18n/locales/zh.jsView on unpkg · L971 164patternName = generic_password
severity = medium
line = 164
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L164 410patternName = generic_password
severity = medium
line = 410
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L410 716patternName = generic_password
severity = medium
line = 716
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L716 830patternName = generic_password
severity = medium
line = 830
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L830 876patternName = generic_password
severity = medium
line = 876
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L876 986patternName = generic_password
severity = medium
line = 986
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/fr.js
dist/i18n/locales/fr.jsView on unpkg · L986 165patternName = generic_password
severity = medium
line = 165
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L165 409patternName = generic_password
severity = medium
line = 409
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L409 718patternName = generic_password
severity = medium
line = 718
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L718 836patternName = generic_password
severity = medium
line = 836
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L836 880patternName = generic_password
severity = medium
line = 880
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L880 987patternName = generic_password
severity = medium
line = 987
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/hu.js
dist/i18n/locales/hu.jsView on unpkg · L987 164patternName = generic_password
severity = medium
line = 164
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/it.js
dist/i18n/locales/it.jsView on unpkg · L164 714patternName = generic_password
severity = medium
line = 714
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/it.js
dist/i18n/locales/it.jsView on unpkg · L714 983patternName = generic_password
severity = medium
line = 983
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/it.js
dist/i18n/locales/it.jsView on unpkg · L983 164patternName = generic_password
severity = medium
line = 164
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L164 407patternName = generic_password
severity = medium
line = 407
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L407 711patternName = generic_password
severity = medium
line = 711
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L711 823patternName = generic_password
severity = medium
line = 823
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L823 866patternName = generic_password
severity = medium
line = 866
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L866 972patternName = generic_password
severity = medium
line = 972
MediumSecret Pattern
Hardcoded password in dist/i18n/locales/es.js
dist/i18n/locales/es.jsView on unpkg · L972 169patternName = generic_password
severity = medium
line = 169
416patternName = generic_password
severity = medium
line = 416
725patternName = generic_password
severity = medium
line = 725
835patternName = generic_password
severity = medium
line = 835
880patternName = generic_password
severity = medium
line = 880
992patternName = generic_password
severity = medium
line = 992
185patternName = generic_password
severity = medium
line = 185
MediumSecret Pattern
Hardcoded password in src/auth/sign-in-form.tsx
src/auth/sign-in-form.tsxView on unpkg · L185 91patternName = generic_password
severity = medium
line = 91
MediumSecret Pattern
Hardcoded password in src/auth/register-form.tsx
src/auth/register-form.tsxView on unpkg · L91 src/account/email-change-setting.tsxView file 70patternName = generic_password
severity = medium
line = 70
MediumSecret Pattern
Hardcoded password in src/account/email-change-setting.tsx
src/account/email-change-setting.tsxView on unpkg · L70 198patternName = generic_password
severity = medium
line = 198
450patternName = generic_password
severity = medium
line = 450
769patternName = generic_password
severity = medium
line = 769
877patternName = generic_password
severity = medium
line = 877
Medium
Secret Pattern
dist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/fr.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/hu.js
MediumSecret Patterndist/i18n/locales/it.js
MediumSecret Patterndist/i18n/locales/it.js
MediumSecret Patterndist/i18n/locales/it.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/locales/es.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patterndist/i18n/german.js
MediumSecret Patternsrc/auth/sign-in-form.tsx
MediumSecret Patternsrc/auth/register-form.tsx
MediumSecret Patternsrc/account/email-change-setting.tsx
MediumSecret Patternsrc/i18n/german.ts
MediumSecret Patternsrc/i18n/german.ts
MediumSecret Patternsrc/i18n/german.ts
MediumSecret Patternsrc/i18n/german.ts
LowNon Install Lifecycle Scripts
prepublishOnly
Behavioral surface
NetworkHighEntropyStringsTelemetryUrlStringsManifest: clean