registry / @elyracode/web-ui / 0.9.12

@elyracode/web-ui@0.9.12

Reusable web UI components for AI chat interfaces powered by @elyra/ai

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a browser UI library for AI chat, with user-invoked document fetching, local provider discovery, local browser storage, and sandboxed runtime helpers aligned with its advertised functionality.

Static reason

One or more suspicious static signals were detected.

Trigger

User configures providers, loads attachments/documents, or invokes chat tools at runtime.

Impact

No evidence of credential theft, install-time execution, persistence, or unauthorized network exfiltration.

Mechanism

Browser UI components with local storage, user-directed fetches, and sandboxed iframe execution.

Rationale

Static source inspection found suspicious primitives, but they are package-aligned and user-invoked for an AI chat UI/document/runtime feature set. No concrete malicious behavior or unconsented lifecycle/runtime exfiltration path was identified.

Evidence

package.jsondist/index.jssrc/index.tssrc/utils/proxy-utils.tssrc/utils/auth-token.tssrc/utils/model-discovery.tssrc/tools/extract-document.tssrc/utils/attachment-utils.tssrc/components/SandboxedIframe.tssrc/tools/javascript-repl.tssrc/storage/stores/provider-keys-store.ts

Network endpoints6

/xlsx-0.20.3/xlsx-0.20.3.tgz

@elyracode/web-ui@0.9.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code