registry / @hanzo/ui-shadcn / 5.7.4

@hanzo/ui-shadcn@5.7.4

Multi-framework UI library with React, Vue, Svelte, and React Native support. Based on shadcn/ui with comprehensive framework coverage. (Formerly @hanzo/ui ≤5.x; @hanzo/ui@8+ is the @hanzo/gui-based unified lib.)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 765 file(s), 4.08 MB of source, external domains: algolia.com, analytics.hanzo.ai, analytics.lux.network, analytics.pars.network, analytics.zoo.ngo, api.github.com, api.hanzo.ai, app.cal.com, auto.hanzo.ai, auto.lux.network, auto.pars.network, auto.zoo.ngo, base.hanzo.ai, base.lux.network, base.pars.network, base.zoo.ngo, billing.hanzo.ai, billing.lux.network, billing.pars.network, billing.zoo.ngo, bot.lux.network, bot.pars.network, bot.zoo.ngo, cal.com, captable.hanzo.ai, captable.lux.network, captable.pars.network, captable.zoo.ngo, chat.pars.network, chat.zoo.ngo, cloud.hanzo.ai, cloud.lux.network, cloud.pars.network, cloud.zoo.network, commerce.hanzo.ai, commerce.lux.network, commerce.pars.network, commerce.zoo.ngo, console.hanzo.ai, console.lux.network, console.pars.network, console.zoo.ngo, dataroom.hanzo.ai, dataroom.lux.network, dataroom.pars.network, dataroom.zoo.ngo, dns.hanzo.ai, dns.lux.network, dns.pars.network, dns.zoo.ngo

Source & flagged code

3 flagged

bin/create-registry.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Simple registry builder for @hanzo/ui

5 * Creates the necessary structure for the MCP registry

6 */

8const fs = require('fs');

9const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create-registry.jsView on unpkg · L7

11// Configuration

12const REGISTRY_DIR = path.resolve(__dirname, '../registry');

13const PUBLIC_DIR = path.resolve(__dirname, '../public');

14const OUTPUT_FILE = path.resolve(__dirname, '../registry.json');

15const REGISTRY_STYLES = ['default', 'new-york'];

17// Registry schema

18const registrySchema = {

19 "$schema": "https://ui.hanzo.com/schema/registry.json",

20 "name": "hanzo",

21 "homepage": "https://ui.hanzo.ai",

22 "items": []

23};

25// Create the basic registry structure

26function createRegistry() {

27 console.log('Creating registry structure...');

bin/cli.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Main CLI entry point for @hanzo/ui

5 * Supports various commands including registry:mcp

6 */

8const { program } = require("commander");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/cli.jsView on unpkg · L7

bin/start-mcp-server.shView file

•path = bin/start-mcp-server.sh kind = build_helper sizeBytes = 740 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/start-mcp-server.shView on unpkg

Source & flagged code

3 flagged · loading source

bin/create-registry.jsView file

7L8: const fs = require('fs'); L9: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create-registry.jsView on unpkg · L7

bin/cli.jsView file

7package = @hanzo/ui-shadcn; repositoryIdentity = ui; dependency = commander L7: L8: const { program } = require("commander"); L9:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/cli.jsView on unpkg · L7

bin/start-mcp-server.shView file

•path = bin/start-mcp-server.sh kind = build_helper sizeBytes = 740 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/start-mcp-server.shView on unpkg

Findings

1 High5 Medium5 Low

HighCopied Package Dependency Bridgebin/cli.js

MediumDynamic Requirebin/create-registry.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/start-mcp-server.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/create-registry.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Simple registry builder for @hanzo/ui

5 * Creates the necessary structure for the MCP registry

6 */

8const fs = require('fs');

9const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create-registry.jsView on unpkg · L7

11// Configuration

12const REGISTRY_DIR = path.resolve(__dirname, '../registry');

13const PUBLIC_DIR = path.resolve(__dirname, '../public');

14const OUTPUT_FILE = path.resolve(__dirname, '../registry.json');

15const REGISTRY_STYLES = ['default', 'new-york'];

17// Registry schema

18const registrySchema = {

19 "$schema": "https://ui.hanzo.com/schema/registry.json",

20 "name": "hanzo",

21 "homepage": "https://ui.hanzo.ai",

22 "items": []

23};

25// Create the basic registry structure

26function createRegistry() {

27 console.log('Creating registry structure...');

bin/cli.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Main CLI entry point for @hanzo/ui

5 * Supports various commands including registry:mcp

6 */

8const { program } = require("commander");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/cli.jsView on unpkg · L7

bin/start-mcp-server.shView file

•path = bin/start-mcp-server.sh kind = build_helper sizeBytes = 740 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/start-mcp-server.shView on unpkg