registry / @embarkai/ui-kit / 0.6.9
@embarkai/ui-kit@0.6.9
React UI components and hooks for embarkAI authentication and Account Abstraction
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed bundle sends authentication and backup data to the package’s configured first-party services. Although login checks backup status, it does not create a backup by default; the scanner’s network, credential, and dynamic-code leads did not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Iframe authentication or wallet recovery operations; login also checks server backup status.
Impact
No malicious impact identified in the inspected source.
Mechanism
Requests use configured EmbarkAI services. Login-time backup creation is gated off by default; enabled backups encrypt keyshares before upload.
AI rationale
The reviewed bundle sends authentication and backup data to the package’s configured first-party services. Although login checks backup status, it does not create a backup by default; the scanner’s network, credential, and dynamic-code leads did not establish malicious behavior.
Evidence
package.jsondist/index.jsdist/iframe/main.jsdist/iframe/index.html
Network endpoints2
api.embarkai.ioauth.embarkai.io
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes React authentication and account-abstraction components and exports the bundled JavaScript entrypoints.
- The configured network destinations are the package’s EmbarkAI API and authentication hosts.
- Login checks whether a server backup exists, but backup creation is disabled by default and guarded by an explicit allowCreate check.
- When backup creation is enabled, the keyshare is encrypted into an envelope and checked before upload.
- The iframe restricts SDK_AUTH messages to HTTPS or localhost and checks other messages against allowed origins.
Evidence against
- The iframe bundle handles access tokens and sends encrypted wallet backup envelopes to the first-party vault; these flows match the package’s stated purpose.
- The bundle contains a new Function call in its WebAssembly import bridge, but the inspected code does not show unrelated dynamic execution.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
Source & flagged code
13 flaggeddist/iframe/main.jsView file
20__export(crypto_utils_exports, {
L21: base64ToBytes: () => base64ToBytes,
L22: bytesToBase64: () => bytesToBase64,
...
L169: return {
L170: data: bytesToBase64(new Uint8Array(encryptedData)),
L171: iv: bytesToBase64(iv),
...
L659: const idempotencyKey2 = crypto.randomUUID ? crypto.randomUUID() : `backup-${Date.now()}`;
L660: const response = await fetch(shareUrl("", encryptedShare.ownerAddress), {
L661: method: "PUT",
...
L5369: }
L5370: async upload(fileName, content, usePrivateStorage = true) {
L5371: if (!this.isAuthenticated()) {
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/iframe/main.jsView on unpkg · L206585imports.wbg.__wbg_newnoargs_105ed471475aaf50 = function(arg0, arg1) {
L6586: const ret = new Function(getStringFromWasm0(arg0, arg1));
L6587: return ret;
High
347patternName = generic_password
severity = medium
line = 347
Medium
Secret Pattern
Findings
3 Critical3 High10 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/iframe/main.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighEvaldist/iframe/main.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighSemantic Analysis Limiteddist/styles.css
MediumSecret Patterndist/iframe/main.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/iframe/dkls23_wasm_bg.wasm
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/iframe/main.js
MediumSecret Pattern
Affected versions and remediation
This report applies to @embarkai/ui-kit@0.6.9.
See all versions of @embarkai/ui-kit for other recorded verdicts.
- Review the evidence and your use of @embarkai/ui-kit@0.6.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.