registry / @embarkai/ui-kit / 0.4.63
@embarkai/ui-kit@0.4.63
⚠ Under reviewReact UI components and hooks for EmbarkAI authentication and Account Abstraction
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 23 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
14 flaggeddist/iframe/main.jsView file
13__export(crypto_utils_exports, {
L14: base64ToBytes: () => base64ToBytes,
L15: bytesToBase64: () => bytesToBase64,
...
L156: return {
L157: data: bytesToBase64(new Uint8Array(encryptedData)),
L158: iv: bytesToBase64(iv),
...
L503: const idempotencyKey = crypto.randomUUID ? crypto.randomUUID() : `backup-${Date.now()}`;
L504: const response = await fetch(`${SHARE_VAULT_URL}/v1/shares/me`, {
L505: method: "PUT",
...
L1900: }
L1901: async upload(fileName, content, usePrivateStorage = true) {
L1902: if (!this.isAuthenticated()) {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/iframe/main.jsView on unpkg · L132741imports.wbg.__wbg_newnoargs_105ed471475aaf50 = function(arg0, arg1) {
L2742: const ret = new Function(getStringFromWasm0(arg0, arg1));
L2743: return ret;
High
•matchType = previous_version_dangerous_delta
matchedPackage = @embarkai/ui-kit@0.4.46
matchedIdentity = npm:QGVtYmFya2FpL3VpLWtpdA:0.4.46
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical3 High14 Medium5 Low
CriticalRemote Asset Decode Executedist/iframe/main.js
HighChild Process
HighEvaldist/iframe/main.js
HighPrevious Version Dangerous Deltadist/iframe/main.js
MediumSecret Patterndist/iframe/main.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/iframe/dkls23_wasm_bg.wasm
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/iframe/main.js
MediumSecret Patterndist/index.js
MediumSecret Patterndist/index.js
MediumSecret Patterndist/index.js
MediumSecret Pattern
Affected versions and remediation
This report applies to @embarkai/ui-kit@0.4.63.
See all versions of @embarkai/ui-kit for other recorded verdicts.
- Review the evidence and your use of @embarkai/ui-kit@0.4.63 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.