@nexus-cross/dapp-ui@1.4.1
Shared DApp UI components for the CROSS ecosystem — AppLauncher, WalletInfo, WalletPortfolio, WalletConnectModal
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe crypto clipboard warning is not supported: the flagged code reads clipboard text only after a user selects Paste. However, tracked runtime events can send the embedding site's hostname to a hardcoded Sentry endpoint, which makes this undisclosed identifying telemetry suspicious.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A tracked UI interaction invokes analytics; error reporting can also initialize Sentry when used.
Impact
The package's analytics recipient can learn the hostname of sites embedding the UI and associated feature/action event metadata.
Mechanism
The bundle initializes Sentry in production and includes the current page hostname in tracked event tags.
AI rationale
The crypto clipboard warning is not supported: the flagged code reads clipboard text only after a user selects Paste. However, tracked runtime events can send the embedding site's hostname to a hardcoded Sentry endpoint, which makes this undisclosed identifying telemetry suspicious.
Evidence
dist/index.js
Network endpoints1
o4511668907081728.ingest.de.sentry.io
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The bundle configures a Sentry DSN at o4511668907081728.ingest.de.sentry.io and defaults telemetry sampling to 10%.
- Sentry initializes with its built-in DSN and is enabled by default in production.
- Tracked UI events are sent with tags that include window.location.hostname, device type, and in-app status.
- The clipboard code reads text only when the user selects the recipient field’s “Paste from clipboard” action.
Evidence against
- The package describes itself as a shared DApp UI component library, consistent with its wallet UI and clipboard paste behavior.
- The clipboard path reads text into a recipient field; no clipboard rewriting was identified.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
1function Hd(e){try{return import.meta.env?.[e]}catch{return}}function _d(e){if(!(typeof process>"u"))return process.env?.[e]}function it(e){if(e)return Qd(e);let t=Hd("VITE_CROSSX_...
L2: `);de(`.al-trigger-btn{--at-bg: transparent;--at-bg-hover: #eaedf1;--at-color: var(--ds-content-high, rgba(0, 0, 0, .85));--at-border: none;--at-border-radius: 8px;--at-size: 36px;...
...
L4: `);de(`.al-popover-content{-webkit-font-smoothing:antialiased;z-index:100001;border-radius:24px;background:var(--al-bg);border:1px solid var(--al-popover-border, var(--al-border));...
L5: `);de("");import{jsx as al}from"react/jsx-runtime";function rc({env:e,theme:t="dark",mobileBreakpoint:r=768,domain:n,children:o}){let i=Oo(`(max-width: ${r}px)`),[a,s]=Bo.useState(...
L6: `).toLowerCase()}function h0(e){if(e ins
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/index.jsView on unpkg · L11tion as Ah,makeFetchTransport as Mh}from"@sentry/react";var Lh="https://[redacted]@o4511668907081728.ingest.de.sentry.io/4511705324126289",Dh=`dapp-ui@${co}`,Mo=null,Vd
Medium
Ai Review Evidence
The bundle configures a Sentry DSN at o4511668907081728.ingest.de.sentry.io and defaults telemetry sampling to 10%.
dist/index.jsView on unpkg · L11
Findings
2 Critical7 Medium3 Low
CriticalClipboard Crypto Hijackdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nexus-cross/dapp-ui@1.4.1.
See all versions of @nexus-cross/dapp-ui for other recorded verdicts.
- Review the evidence and your use of @nexus-cross/dapp-ui@1.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.