registry / @lacneu/atrium / 0.30.0

@lacneu/atrium@0.30.0

⚠ Under review

Atrium — public, self-hostable, Convex-backed web chat UI for AI agent gateways (OpenClaw today, Hermes next). Ships an origin-agnostic static bundle (Convex URL injected at runtime via /config.json).

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 1.90 MB of source, external domains: docs.convex.dev, dummy.com, example.com, github.com, happy-otter-123.convex.cloud, inlang.com, json-schema.org, otlp.example.com, radix-ui.com, react.dev, www.ibm.com, www.w3.org

Source & flagged code

1 flagged

dist/assets/dist-BOukL7gG.jsView file

Lines 1-21javascript

1import{a as e,i as t,l as n,n as r,r as i,t as a}from"./bundle-mjs-C73ZY4La.js";for(var o=[],s=[],c=Uint8Array,l=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`,u=0,d=l.length;u<d;++u)o[u]=l[u],s[l.charCodeAt(u)]=u;s[45]=62,s[95]=63;function f(e){var t=e.length;if(t%4>0)throw Error(`Invalid string. Length must be a multiple of 4`);var n=e.indexOf(`=`);n===-1&&(n=t);var r=n===t?0:4-n%4;return[n,r]}function p(e,t,n){return(t+n)*3/4-n}function m(e){var t,n=f(e),r=n[0],i=n[1],a=new c(p(e,r,i)),o=0,l=i>0?r-4:r,u;for(u=0;u<l;u+=4)t=s[e.charCodeAt(u)]<<18|s[e.charCodeAt(u+1)]<<12|s ...

2 Called by client`}function et(e,t){return t.data=e.errorData,t}function k(e){let t=e.split(`:`),n,r;return t.length===1?(n=t[0],r=`default`):(n=t.slice(0,t.length-1).join(`:`),r=t[t.length-1]),n.endsWith(`.js`)&&(n=n.slice(0,-3)),`${n}:${r}`}function A(e,t){return JSON.stringify({udfPath:k(e),args:C(t)})}function tt(e,t,n){let{initialNumItems:r,id:i}=n;return JSON.stringify({type:`paginated`,udfPath:k(e),args:C(t),options:C({initialNumItems:r,id:i})})}var nt=Object.defineProperty,rt=(e,t,n)=>t in e?nt(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n,j=(e,t,n)=>rt(e,typeof t==` ...

3If trying to deploy to production, make sure to follow all the instructions found at https://docs.convex.dev/production/hosting/

4If running locally, make sure to run \`convex dev\` and ensure the .env.local file is populated.`);if(typeof e!=`string`)throw Error(`ConvexReactClient requires a URL like 'https://happy-otter-123.convex.cloud', received something of type ${typeof e} instead.`);if(!e.includes(`://`))throw Error(`Provided address was not an absolute URL.`);this.address=e,this.listeners=new Map,this._logger=t?.logger

5 .${mi} {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/assets/dist-BOukL7gG.jsView on unpkg · L1

6 overflow: hidden ${r};

7 padding-right: ${s}px ${r};

8 }

9 body[${Y}] {

10 overflow: hidden ${r};

11 overscroll-behavior: contain;

12 ${[t&&`position: relative ${r};`,n===`margin`&&`

13 padding-left: ${i}px;

14 padding-top: ${a}px;

15 padding-right: ${o}px;

16 margin-left:0;

17 margin-top:0;

18 margin-right: ${s}px ${r};

19 `,n===`padding`&&`padding-right: ${s}px ${r};`].filter(Boolean).join(``)}

20 }

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/assets/dist-BOukL7gG.jsView file

1import{a as e,i as t,l as n,n as r,r as i,t as a}from"./bundle-mjs-C73ZY4La.js";for(var o=[],s=[],c=Uint8Array,l=`[redacted]+/`,... L2: Called by client`}function et(e,t){return t.data=e.errorData,t}function k(e){let t=e.split(`:`),n,r;return t.length===1?(n=t[0],r=`default`):(n=t.slice(0,t.length-1).join(`:`),r=t[... L3: If trying to deploy to production, make sure to follow all the instructions found at https://docs.convex.dev/production/hosting/ L4: If running locally, make sure to run \`convex dev\` and ensure the .env.local file is populated.`);if(typeof e!=`string`)throw Error(`ConvexReactClient requires a URL like 'https:/... L5: .${mi} { ... L43: .allow-interactivity-${e} {pointer-events: all;} L44: `},ua=0,Z=[];function da(e){var t=w.useRef([]),n=w.useRef([0,0]),r=w.useRef(),i=w.useState(ua++)[0],a=w.useState(Ii)[0],o=w.useRef(e);w.useEffect(function(){o.current=e},[e]),w.use...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/assets/dist-BOukL7gG.jsView on unpkg · L1

Findings

1 Critical3 Medium5 Low

CriticalCredential Exfiltrationdist/assets/dist-BOukL7gG.js

MediumDynamic Require

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/assets/dist-BOukL7gG.jsView file

Lines 1-21javascript

3If trying to deploy to production, make sure to follow all the instructions found at https://docs.convex.dev/production/hosting/

5 .${mi} {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/assets/dist-BOukL7gG.jsView on unpkg · L1

6 overflow: hidden ${r};

7 padding-right: ${s}px ${r};

8 }

9 body[${Y}] {

10 overflow: hidden ${r};

11 overscroll-behavior: contain;

12 ${[t&&`position: relative ${r};`,n===`margin`&&`

13 padding-left: ${i}px;

14 padding-top: ${a}px;

15 padding-right: ${o}px;

16 margin-left:0;

17 margin-top:0;

18 margin-right: ${s}px ${r};

19 `,n===`padding`&&`padding-right: ${s}px ${r};`].filter(Boolean).join(``)}

20 }

Long lines were clipped for display.