registry / Telemetry / @nexus-cross/dapp-ui

@nexus-cross/dapp-ui

Shared DApp UI components for the CROSS ecosystem — AppLauncher, WalletInfo, WalletPortfolio, WalletConnectModal

This report shows the evidence for @nexus-cross/dapp-ui@1.4.1. 0 of 8 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The crypto clipboard warning is not supported: the flagged code reads clipboard text only after a user selects Paste. However, tracked runtime events can send the embedding site's hostname to a hardcoded Sentry endpoint, which makes this undisclosed identifying telemetry suspicious.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A tracked UI interaction invokes analytics; error reporting can also initialize Sentry when used.

Impact

The package's analytics recipient can learn the hostname of sites embedding the UI and associated feature/action event metadata.

Mechanism

The bundle initializes Sentry in production and includes the current page hostname in tracked event tags.

AI rationale

Evidence

dist/index.js

Network endpoints1

o4511668907081728.ingest.de.sentry.io

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The bundle configures a Sentry DSN at o4511668907081728.ingest.de.sentry.io and defaults telemetry sampling to 10%.
Sentry initializes with its built-in DSN and is enabled by default in production.
Tracked UI events are sent with tags that include window.location.hostname, device type, and in-app status.
The clipboard code reads text only when the user selects the recipient field’s “Paste from clipboard” action.

Evidence against

The package describes itself as a shared DApp UI component library, consistent with its wallet UI and clipboard paste behavior.
The clipboard path reads text into a recipient field; no clipboard rewriting was identified.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.30 MB of source, external domains: arbiscan.io, basescan.org, bscscan.com, chromewebstore.google.com, contents.crossdefi.io, contents.crosstoken.io, contents.onechain.nexus, crossd-dashboard-api.crossdefi.io, dev-portrait.crosstoken.io, dev-relay-protocol-api.onechain.nexus, dev-stake.ogfcorp.com, dev.onechain.nexus, etherscan.io, explorer.onechain.nexus, onechain.nexus, polygonscan.com, portrait.crosstoken.io, prediction.crossdefi.io, public.bnbstatic.com, relay-protocol-api.onechain.nexus, scan.crosstoken.io, solscan.io, stake.ogfcorp.com, stg-contents.crosstoken.io, stg-contents.onechain.nexus, stg-explorer.onechain.nexus, stg-prediction.crossdefi.io, stg-stake.ogfcorp.com, stg-swap-api.crossdefi.io, stg.crossdefi.io, stg.crossnft.io, stg.onechain.nexus, stg.oneusd.money, swap-api.crossdefi.io, terms.onechain.nexus, testnet.bscscan.com, upload.wikimedia.org, www.crossdefi.io, www.crossnft.io, www.onechain.nexus, www.oneusd.money, www.w3.org

Source & flagged code

6 flagged

dist/index.jsView file

1function Hd(e){try{return import.meta.env?.[e]}catch{return}}function _d(e){if(!(typeof process>"u"))return process.env?.[e]}function it(e){if(e)return Qd(e);let t=Hd("VITE_CROSSX_... L2: `);de(`.al-trigger-btn{--at-bg: transparent;--at-bg-hover: #eaedf1;--at-color: var(--ds-content-high, rgba(0, 0, 0, .85));--at-border: none;--at-border-radius: 8px;--at-size: 36px;... ... L4: `);de(`.al-popover-content{-webkit-font-smoothing:antialiased;z-index:100001;border-radius:24px;background:var(--al-bg);border:1px solid var(--al-popover-border, var(--al-border));... L5: `);de("");import{jsx as al}from"react/jsx-runtime";function rc({env:e,theme:t="dark",mobileBreakpoint:r=768,domain:n,children:o}){let i=Oo(`(max-width: ${r}px)`),[a,s]=Bo.useState(... L6: `).toLowerCase()}function h0(e){if(e ins

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

dist/index.jsView on unpkg · L1

1tion as Ah,makeFetchTransport as Mh}from"@sentry/react";var Lh="https://[redacted]@o4511668907081728.ingest.de.sentry.io/4511705324126289",Dh=`dapp-ui@${co}`,Mo=null,Vd

Medium

Ai Review Evidence

The bundle configures a Sentry DSN at o4511668907081728.ingest.de.sentry.io and defaults telemetry sampling to 10%.

dist/index.jsView on unpkg · L1

Findings

2 Critical7 Medium3 Low

CriticalClipboard Crypto Hijackdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @nexus-cross/dapp-ui@1.4.1.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @nexus-cross/dapp-ui@1.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-01 05:59:26.486Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

8 known versions

1.4.1latestshownSuspiciousTelemetryWarnPublishedAug 27, 2026, 1:53 AM 1.4.0Suspicious—WarnUnder ReviewAug 14, 2026, 6:10 AM 1.3.17Suspicious—WarnUnder ReviewAug 11, 2026, 4:25 AM 1.3.14Suspicious—WarnUnder ReviewAug 6, 2026, 9:43 AM

registry / Telemetry / @nexus-cross/dapp-ui

@nexus-cross/dapp-ui

Shared DApp UI components for the CROSS ecosystem — AppLauncher, WalletInfo, WalletPortfolio, WalletConnectModal

This report shows the evidence for @nexus-cross/dapp-ui@1.4.1. 0 of 8 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A tracked UI interaction invokes analytics; error reporting can also initialize Sentry when used.

Impact

The package's analytics recipient can learn the hostname of sites embedding the UI and associated feature/action event metadata.

Mechanism

The bundle initializes Sentry in production and includes the current page hostname in tracked event tags.

AI rationale

Evidence

dist/index.js

Network endpoints1

o4511668907081728.ingest.de.sentry.io

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The bundle configures a Sentry DSN at o4511668907081728.ingest.de.sentry.io and defaults telemetry sampling to 10%.
Sentry initializes with its built-in DSN and is enabled by default in production.
Tracked UI events are sent with tags that include window.location.hostname, device type, and in-app status.
The clipboard code reads text only when the user selects the recipient field’s “Paste from clipboard” action.

Evidence against

The package describes itself as a shared DApp UI component library, consistent with its wallet UI and clipboard paste behavior.
The clipboard path reads text into a recipient field; no clipboard rewriting was identified.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

6 flagged

dist/index.jsView file

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

dist/index.jsView on unpkg · L1

1tion as Ah,makeFetchTransport as Mh}from"@sentry/react";var Lh="https://[redacted]@o4511668907081728.ingest.de.sentry.io/4511705324126289",Dh=`dapp-ui@${co}`,Mo=null,Vd

Medium

Ai Review Evidence

The bundle configures a Sentry DSN at o4511668907081728.ingest.de.sentry.io and defaults telemetry sampling to 10%.

dist/index.jsView on unpkg · L1

Findings

2 Critical7 Medium3 Low

CriticalClipboard Crypto Hijackdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @nexus-cross/dapp-ui@1.4.1.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @nexus-cross/dapp-ui@1.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-01 05:59:26.486Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

8 known versions