registry / @hitachivantara/uikit-react-core / 6.9.2

@hitachivantara/uikit-react-core@6.9.2

⚠ Under review

UI Kit Core React components.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 439 file(s), 880 KB of source

Source & flagged code

2 flagged

dist/TimePicker/Placeholder.jsView file

Lines 1-38javascript

1import { forwardRef, useRef } from "react";

2import { jsx, jsxs } from "react/jsx-runtime";

3import { useDateSegment } from "react-aria/useDateField";

4//#region src/TimePicker/Placeholder.tsx

5/** Convert `Date` into `hh:mm:ss` format */

6var getDateValue = (date) => {

7 if (!date) return "";

8 const { hour, minute, second } = date;

9 return [

10 hour,

11 minute,

12 second

13 ].map((el) => String(el).padStart(2, "0")).join(":");

14};

15var PlaceholderSegment = ({ segment, state, value }) => {

16 const ref = useRef(null);

17 const { segmentProps } = useDateSegment(segment, state, ref);

18 if (segment.type === "literal" && segment.text === "⁦") return;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TimePicker/Placeholder.jsView on unpkg · L18

19 return /* @__PURE__ */ jsx("div", {

20 ref,

21 ...segmentProps,

22 children: value

23 });

24};

25var Placeholder = forwardRef(function Placeholder(props, ref) {

26 const { name, state, placeholders, onKeyDown, ...others } = props;

27 const { value, segments } = state;

28 return /* @__PURE__ */ jsxs("div", {

29 ref,

30 onKeyDown: (event) => {

31 event.stopPropagation();

32 onKeyDown?.(event);

33 },

34 ...others,

35 children: [name && /* @__PURE__ */ jsx("input", {

36 type: "hidden",

37 name,

38 value: getDateValue(value)

•Trigger-reachable chain: manifest.module -> dist/index.js -> dist/TimePicker/TimePicker.js -> dist/TimePicker/Placeholder.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/TimePicker/Placeholder.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/TimePicker/Placeholder.jsView file

18contains invisible/control Unicode U+2066 (left-to-right isolate) if (segment.type === "literal" && segment.text === "<U+2066>") return;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TimePicker/Placeholder.jsView on unpkg · L18

•Trigger-reachable chain: manifest.module -> dist/index.js -> dist/TimePicker/TimePicker.js -> dist/TimePicker/Placeholder.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/TimePicker/Placeholder.jsView on unpkg

Findings

2 Critical1 Medium3 Low

CriticalTrojan Source Unicodedist/TimePicker/Placeholder.js

CriticalTrigger Reachable Dangerous Capabilitydist/TimePicker/Placeholder.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/TimePicker/Placeholder.jsView file

Lines 1-38javascript

1import { forwardRef, useRef } from "react";

2import { jsx, jsxs } from "react/jsx-runtime";

3import { useDateSegment } from "react-aria/useDateField";

4//#region src/TimePicker/Placeholder.tsx

5/** Convert `Date` into `hh:mm:ss` format */

6var getDateValue = (date) => {

7 if (!date) return "";

8 const { hour, minute, second } = date;

9 return [

10 hour,

11 minute,

12 second

13 ].map((el) => String(el).padStart(2, "0")).join(":");

14};

15var PlaceholderSegment = ({ segment, state, value }) => {

16 const ref = useRef(null);

17 const { segmentProps } = useDateSegment(segment, state, ref);

18 if (segment.type === "literal" && segment.text === "⁦") return;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/TimePicker/Placeholder.jsView on unpkg · L18

19 return /* @__PURE__ */ jsx("div", {

20 ref,

21 ...segmentProps,

22 children: value

23 });

24};

25var Placeholder = forwardRef(function Placeholder(props, ref) {

26 const { name, state, placeholders, onKeyDown, ...others } = props;

27 const { value, segments } = state;

28 return /* @__PURE__ */ jsxs("div", {

29 ref,

30 onKeyDown: (event) => {

31 event.stopPropagation();

32 onKeyDown?.(event);

33 },

34 ...others,

35 children: [name && /* @__PURE__ */ jsx("input", {

36 type: "hidden",

37 name,

38 value: getDateValue(value)

•Trigger-reachable chain: manifest.module -> dist/index.js -> dist/TimePicker/TimePicker.js -> dist/TimePicker/Placeholder.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/TimePicker/Placeholder.jsView on unpkg