registry / @embarkai/ui-kit / 0.4.128
@embarkai/ui-kit@0.4.128
React UI components and hooks for EmbarkAI authentication and Account Abstraction
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest identifies a React UI kit with no install hooks, and the flagged credential handling is used for an explicit server-backup feature. It exchanges the supplied access token for a scoped EmbarkAI vault token and uploads encrypted keyshare data to that service.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A caller requests server backup through the iframe’s CREATE_BACKUP message handler.
Impact
The reviewed flow sends encrypted backup data and a scoped token to the package’s EmbarkAI service as part of the requested backup.
Mechanism
The handler validates the SDK channel; backup encrypts keyshare data, exchanges the provided access token for a scoped resource token, then uploads to the Share Vault.
AI rationale
The manifest identifies a React UI kit with no install hooks, and the flagged credential handling is used for an explicit server-backup feature. It exchanges the supplied access token for a scoped EmbarkAI vault token and uploads encrypted keyshare data to that service.
Network endpoints2
api.embarkai.io/vault/v1/shares/meapi.embarkai.io/api/auth/token/exchange
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a React UI kit and exposes bundled UI entry points; it declares no install lifecycle scripts.
- The server backup flow exchanges an access token for a narrowly scoped Share Vault resource token and sends that token to the package’s EmbarkAI vault endpoint.
- Server backup encrypts keyshare data before upload.
- Backup runs through an explicit CREATE_BACKUP request after SDK channel validation.
Evidence against
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
15 flaggeddist/iframe/main.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @embarkai/ui-kit@0.4.127
matchedIdentity = npm:QGVtYmFya2FpL3VpLWtpdA:0.4.127
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/iframe/main.jsView on unpkg4514imports.wbg.__wbg_newnoargs_105ed471475aaf50 = function(arg0, arg1) {
L4515: const ret = new Function(getStringFromWasm0(arg0, arg1));
L4516: return ret;
High
341patternName = generic_password
severity = medium
line = 341
Medium
Findings
3 Critical3 High12 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/iframe/main.js
HighEvaldist/iframe/main.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighSemantic Analysis Limiteddist/styles.css
MediumSecret Patterndist/iframe/main.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/iframe/dkls23_wasm_bg.wasm
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/iframe/main.js
MediumSecret Pattern
Affected versions and remediation
This report applies to @embarkai/ui-kit@0.4.128.
See all versions of @embarkai/ui-kit for other recorded verdicts.
- Review the evidence and your use of @embarkai/ui-kit@0.4.128 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.