registry / @nextclaw/ui / 0.15.13

@nextclaw/ui@0.15.13

⚠ Under review

Official NextClaw Web UI package.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 646 file(s), 8.49 MB of source, external domains: 127.0.0.1, api.example.com, api.minimax.io, api.minimaxi.com, chevrotain.io, docs.nextclaw.io, en.wikipedia.org, github.com, langium.org, nextclaw-platform-console.pages.dev, nextclaw.local, open.bocha.cn, open.feishu.cn, open.larksuite.com, platform.nextclaw.io, radix-ui.com, reactjs.org, rolldown.rs, schemas.microsoft.com, schemas.openxmlformats.org, skillhub.cn, stuk.github.io, www.w3.org

Source & flagged code

2 flagged

dist/assets/chunk-KEIR6QF5-BgdDoWEH.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Da(e){let t=typeof e==`string`?new RegExp(e):e;return Ea.some(e=>t.test(e))}o(Da,`isWhitespace`);function Oa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(Oa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/chunk-KEIR6QF5-BgdDoWEH.jsView on unpkg · L46

package.jsonView file

Lines 42-70json

42 "@nextclaw/agent-chat": "0.3.7",

43 "@nextclaw/agent-chat-ui": "0.6.13",

44 "@nextclaw/ncp-react": "0.5.11"

45 },

46 "devDependencies": {

47 "@testing-library/react": "^16.3.0",

48 "@testing-library/user-event": "^14.6.1",

49 "@types/react": "^18.3.12",

50 "@types/react-dom": "^18.3.1",

51 "@vitejs/plugin-react": "^6.0.1",

52 "autoprefixer": "^10.4.20",

53 "jsdom": "^25.0.1",

54 "postcss": "^8.4.49",

55 "prettier": "^3.3.3",

56 "tailwindcss": "^3.4.15",

57 "tailwindcss-animate": "^1.0.7",

58 "typescript": "^5.6.3",

59 "vite": "^8.0.3",

60 "vitest": "^4.1.2"

61 },

62 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L62

63 "dev": "vite",

64 "build": "vite build",

65 "preview": "vite preview",

66 "lint": "eslint .",

67 "tsc": "tsc --noEmit",

68 "test": "vitest run"

69 }

70}

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code