registry / @embarkai/ui-kit / 0.4.118
@embarkai/ui-kit@0.4.118
⚠ Under reviewReact UI components and hooks for EmbarkAI authentication and Account Abstraction
AI Security Review
scanned 12d ago · by lpm-firewall-aiInspected authentication and Google Drive calls use their intended service destinations, and the Google token flow requests consent. Runtime dependencies including @embarkai/core remain unresolved in this snapshot, so manual review is needed to determine their behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer imports the package entrypoint, which loads its runtime dependencies.
Impact
The inspected code does not establish an attack, but the unresolved dependency behavior prevents a clean determination.
Mechanism
The bundle imports @embarkai/core and other external modules; their behavior could not be resolved from the available source.
AI rationale
Inspected authentication and Google Drive calls use their intended service destinations, and the Google token flow requests consent. Runtime dependencies including @embarkai/core remain unresolved in this snapshot, so manual review is needed to determine their behavior.
Evidence
package.jsondist/index.jsdist/index.cjsdist/iframe/main.js
Network endpoints2
api.embarkai.io/tsswww.googleapis.com/upload/drive/v3/files?uploadType=multipart
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest routes imports and requires through the two distribution bundles and lists no install lifecycle hook.
- The ESM bundle imports @embarkai/core and viem at runtime; the manifest also declares other runtime dependencies whose source is outside the bounded snapshot.
- The auth bundle sends refresh requests to its configured service URL, whose default is an EmbarkAI endpoint.
- The Google Drive backup code requests consent for a Google token and uses it for Google Drive uploads.
- The iframe bundle’s dynamic Function call is part of its WebAssembly import glue.
Evidence against
- Inspected code does not establish credential theft or another concrete attack; the reviewed token requests target the configured service or Google Drive.
- The selected @embarkai/core and other runtime dependency sources are unresolved in this snapshot, so their behavior cannot be assessed here.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
Source & flagged code
14 flaggeddist/iframe/main.jsView file
4507imports.wbg.__wbg_newnoargs_105ed471475aaf50 = function(arg0, arg1) {
L4508: const ret = new Function(getStringFromWasm0(arg0, arg1));
L4509: return ret;
High
336patternName = generic_password
severity = medium
line = 336
Medium
554patternName = generic_password
severity = medium
line = 554
Medium
dist/index.jsView file
Findings
2 Critical3 High12 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighEvaldist/iframe/main.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighSemantic Analysis Limiteddist/styles.css
MediumSecret Patterndist/iframe/main.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/iframe/dkls23_wasm_bg.wasm
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/iframe/main.js
MediumSecret Patterndist/index.js
MediumSecret Patterndist/index.js
Affected versions and remediation
This report applies to @embarkai/ui-kit@0.4.118.
See all versions of @embarkai/ui-kit for other recorded verdicts.
- Review the evidence and your use of @embarkai/ui-kit@0.4.118 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.