registry / @nexus-cross/dapp-ui / 1.3.6
@nexus-cross/dapp-ui@1.3.6
⚠ Under reviewShared DApp UI components for the CROSS ecosystem — AppLauncher, WalletInfo, WalletPortfolio, WalletConnectModal
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
2 flaggeddist/index.jsView file
1function Oa(e){try{return import.meta.env?.[e]}catch{return}}function Wa(e){if(!(typeof process>"u"))return process.env?.[e]}function Ee(e){if(e)return Ua(e);let t=Oa("VITE_CROSSX_...
L2: `);Y(`.al-trigger-btn{--at-bg: transparent;--at-bg-hover: #eaedf1;--at-color: var(--ds-content-high, rgba(0, 0, 0, .85));--at-border: none;--at-border-radius: 8px;--at-size: 36px;-...
...
L4: `);Y(`.al-popover-content{-webkit-font-smoothing:antialiased;z-index:100001;border-radius:24px;background:var(--al-bg);border:1px solid var(--al-popover-border, var(--al-border));b...
L5: `);Y("");import{jsx as Mr}from"react/jsx-runtime";function Za({env:e,theme:t="dark",mobileBreakpoint:n=768,domain:o,children:r}){let i=Pn(`(max-width: ${n}px)`),[a,s]=_n.useState(!...
L6: `).toLowerCase()}function pd(e){if(e ins
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/index.jsView on unpkg · L1dist/index.cjsView file
•Trigger-reachable chain: manifest.main -> dist/index.cjs
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical3 Medium4 Low
CriticalClipboard Crypto Hijackdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nexus-cross/dapp-ui@1.3.6.
See all versions of @nexus-cross/dapp-ui for other recorded verdicts.
- Review the evidence and your use of @nexus-cross/dapp-ui@1.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.