registry / @nexus-cross/dapp-ui / 1.3.11
@nexus-cross/dapp-ui@1.3.11
⚠ Under reviewShared DApp UI components for the CROSS ecosystem — AppLauncher, WalletInfo, WalletPortfolio, WalletConnectModal
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
2 flaggeddist/index.jsView file
1function Ml(e){try{return import.meta.env?.[e]}catch{return}}function El(e){if(!(typeof process>"u"))return process.env?.[e]}function qe(e){if(e)return Al(e);let t=Ml("VITE_CROSSX_...
L2: `);ae(`.al-trigger-btn{--at-bg: transparent;--at-bg-hover: #eaedf1;--at-color: var(--ds-content-high, rgba(0, 0, 0, .85));--at-border: none;--at-border-radius: 8px;--at-size: 36px;...
...
L4: `);ae(`.al-popover-content{-webkit-font-smoothing:antialiased;z-index:100001;border-radius:24px;background:var(--al-bg);border:1px solid var(--al-popover-border, var(--al-border));...
L5: `);ae("");import{jsx as ns}from"react/jsx-runtime";function _l({env:e,theme:t="dark",mobileBreakpoint:r=768,domain:n,children:o}){let i=ao(`(max-width: ${r}px)`),[a,s]=so.useState(...
L6: `).toLowerCase()}function Wm(e){if(e ins
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/index.jsView on unpkg · L1dist/index.cjsView file
•Trigger-reachable chain: manifest.main -> dist/index.cjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical3 Medium4 Low
CriticalClipboard Crypto Hijackdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nexus-cross/dapp-ui@1.3.11.
See all versions of @nexus-cross/dapp-ui for other recorded verdicts.
- Review the evidence and your use of @nexus-cross/dapp-ui@1.3.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.