@eifi1/ui-kit@0.56.0
App-agnostic shared design system: domain-free React components, theme and tokens.
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe runtime signals inspected do not establish an attack, and the flagged secret pattern is ordinary UI copy. However, package metadata explicitly addresses a prior finding and asserts a safe conclusion, which meets the reviewer-manipulation rule.
Static reason
One or more suspicious static signals were detected.
Trigger
A reviewer or automated review system inspects package.json.
Impact
Could mislead a reviewer into dismissing a finding or granting a clean verdict.
Mechanism
The `sideEffects` value discusses a prior finding and asserts the package is safe.
Attack narrative
When package metadata is reviewed, its `sideEffects` value discusses a prior finding and asserts the code is safe, attempting to influence the reviewer’s verdict.
AI rationale
The runtime signals inspected do not establish an attack, and the flagged secret pattern is ordinary UI copy. However, package metadata explicitly addresses a prior finding and asserts a safe conclusion, which meets the reviewer-manipulation rule.
Evidence
package.json
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- The `package.json` `sideEffects` value refers to a prior “finding” and asserts “so this is safe,” attempting to shape a reviewer’s assessment.
Evidence against
- The flagged registration-form text is ordinary guidance about tagged email addresses, not a credential or secret.
- The manifest’s lifecycle scripts are a build step and `husky || true`; no install-time data collection was identified.
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
37 flaggeddist/auth/register-form-labels.jsView file
11patternName = generic_password
severity = medium
line = 11
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/auth/register-form-labels.jsView on unpkg · L11dist/auth/sign-in-form-labels.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
Secret Pattern
Hardcoded password in dist/auth/sign-in-form-labels.js
dist/auth/sign-in-form-labels.jsView on unpkg · L5dist/account/email-change-setting-labels.jsView file
Findings
38 Medium6 Low
MediumSecret Patterndist/auth/register-form-labels.js
MediumNetwork
MediumSecret Patterndist/auth/sign-in-form-labels.js
MediumSecret Patterndist/account/email-change-setting-labels.js
MediumSecret Patterndist/account/account-settings-labels.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/zh.js
MediumSecret Patterndist/i18n/locales/fr.js
Medium
Affected versions and remediation
This report applies to @eifi1/ui-kit@0.56.0.
See all versions of @eifi1/ui-kit for other recorded verdicts.
- Avoid installing @eifi1/ui-kit@0.56.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.