registry / @embarkai/ui-kit / 0.4.127
@embarkai/ui-kit@0.4.127
React UI components and hooks for EmbarkAI authentication and Account Abstraction
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe scanner’s credential and dynamic-evaluation matches resolve to configured authentication flows, an explicitly invoked deposit helper, and generated bindings for a bundled WASM module. The manifest has no install hook, and the inspected source establishes no malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The library is imported by an application; authentication and account operations run when the application invokes them.
Impact
No automatic credential export, remote code retrieval, persistence, or destructive behavior was identified.
Mechanism
Requests target configured EmbarkAI services. A separate exported helper uses a supplied funder key to deposit a specified amount to a caller-provided address.
AI rationale
The scanner’s credential and dynamic-evaluation matches resolve to configured authentication flows, an explicitly invoked deposit helper, and generated bindings for a bundled WASM module. The manifest has no install hook, and the inspected source establishes no malicious behavior.
Evidence
package.jsondist/index.cjsdist/index.jsdist/iframe/main.jsdist/styles.css
Network endpoints2
api.embarkai.ioauth.embarkai.io
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares library entrypoints and build scripts, with no install lifecycle hook.
- The bundle configures EmbarkAI service endpoints and uses the TSS URL for session verification.
- Environment access reads configuration; the funder key is used by an exported deposit helper that sends a caller-specified deposit.
- The iframe’s dynamic function constructor is in WebAssembly bindings, and the loader references a bundled WASM file.
- Inspected dependency snapshots expose React UI primitives; their scripts are build, lint, typecheck, and cleanup tasks.
- The stylesheet is generated Tailwind CSS.
Evidence against
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
14 flaggeddist/iframe/main.jsView file
4507imports.wbg.__wbg_newnoargs_105ed471475aaf50 = function(arg0, arg1) {
L4508: const ret = new Function(getStringFromWasm0(arg0, arg1));
L4509: return ret;
High
336patternName = generic_password
severity = medium
line = 336
Medium
554patternName = generic_password
severity = medium
line = 554
Medium
dist/index.jsView file
Findings
2 Critical3 High12 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighEvaldist/iframe/main.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighSemantic Analysis Limiteddist/styles.css
MediumSecret Patterndist/iframe/main.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/iframe/dkls23_wasm_bg.wasm
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/iframe/main.js
MediumSecret Patterndist/index.js
MediumSecret Patterndist/index.js
Affected versions and remediation
This report applies to @embarkai/ui-kit@0.4.127.
See all versions of @embarkai/ui-kit for other recorded verdicts.
- Review the evidence and your use of @embarkai/ui-kit@0.4.127 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.