registry / @nqlib/nqui / 0.7.2

@nqlib/nqui@0.7.2

A React component library with enhanced UI components and developer tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 76 file(s), 1.37 MB of source, external domains: bazza.dev, radix-ui.com, registry.npmjs.com, www.npmjs.com, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 72-112json

72 "type": "git",

73 "url": "git+https://github.com/nqlib/nqui.git"

74 },

75 "keywords": [

76 "ui",

77 "components",

78 "react",

79 "typescript",

80 "nextjs",

81 "vite",

82 "tailwind",

83 "shadcn",

84 "radix-ui"

85 ],

86 "author": "",

87 "license": "MIT",

88 "engines": {

89 "node": ">=20"

90 },

91 "scripts": {

92 "postinstall": "node scripts/post-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

93 "dev": "vite",

94 "sync:skills": "node scripts/sync-consumer-skills.mjs",

95 "skill:validate": "node scripts/validate-skills.mjs",

96 "build": "npm run sync:skills && npm run build:lib",

97 "build:lib": "vite build --mode library && npm run build:types && npm run build:styles && npm run verify:build && npm run copy:css",

98 "build:types": "tsc -p tsconfig.lib.json",

99 "build:styles": "node scripts/build-styles.js",

100 "verify:build": "node scripts/verify-build.js",

101 "copy:css": "cp src/components/debug/debug.css dist/nqui.css",

102 "build:app": "tsc -b && vite build",

103 "build:all": "npm run build:lib && npm run build:app",

104 "prepublishOnly": "npm run verify:publish",

105 "verify:publish": "node scripts/verify-publish.mjs",

106 "publish:github": "npm publish --registry=https://npm.pkg.github.com",

107 "publish:npm": "node scripts/publish-npmjs.js",

108 "publish:both": "npm run publish:github && npm run publish:npm",

109 "lint": "eslint src scripts --max-warnings 0",

110 "preview": "vite preview",

111 "preview:app": "vite preview --outDir dist-app",

112 "init-debug-css": "node scripts/init-debug-css.js",

README.mdView file

•Vite with `@tailwindcss/vite` often works without `@source`; add the block above when utilities from the package do not show up in CSS.

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Toggle between local (npm link) and published @nqlib/nqui.

4 *

5 * CUSTOMIZE before copying to consumer project:

6 * - PROJECT_NAME: Used in log messages (e.g. "client-saas", "my-app")

7 * - PUBLISHED_VERSION: Semver for published mode (e.g. "^0.5.0")

8 * - USE_LEGACY_PEER_DEPS: true if consumer uses --legacy-peer-deps

9 * - NQUI_DIR: nqui repository root (monorepo with packages/nqui, or standalone nqui repo)

10 */

11import

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/post-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

README.mdView file

•Vite with `@tailwindcss/vite` often works without `@source`; add the block above when utilities from the package do not show up in CSS.

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView file

11import { readFileSync, writeFileSync, existsSync, lstatSync, realpathSync } from "fs"; L12: import { execSync } from "child_process"; L13: import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView on unpkg · L11

177try { L178: execSync("npm unlink @nqlib/nqui", { cwd: root, stdio: "pipe" }); L179: console.log("Unlinked local nqui\n"); ... L189: const installCmd = USE_LEGACY_PEER_DEPS L190: ? `npm install @nqlib/nqui@${PUBLISHED_VERSION} --legacy-peer-deps` L191: : `npm install @nqlib/nqui@${PUBLISHED_VERSION}`;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView on unpkg · L177

Findings

5 High2 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighAi Reviewer ManipulationREADME.md

HighChild Processdocs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.js

HighShell

HighRuntime Package Installdocs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 72-112json

72 "type": "git",

73 "url": "git+https://github.com/nqlib/nqui.git"

74 },

75 "keywords": [

76 "ui",

77 "components",

78 "react",

79 "typescript",

80 "nextjs",

81 "vite",

82 "tailwind",

83 "shadcn",

84 "radix-ui"

85 ],

86 "author": "",

87 "license": "MIT",

88 "engines": {

89 "node": ">=20"

90 },

91 "scripts": {

92 "postinstall": "node scripts/post-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

93 "dev": "vite",

94 "sync:skills": "node scripts/sync-consumer-skills.mjs",

95 "skill:validate": "node scripts/validate-skills.mjs",

96 "build": "npm run sync:skills && npm run build:lib",

97 "build:lib": "vite build --mode library && npm run build:types && npm run build:styles && npm run verify:build && npm run copy:css",

98 "build:types": "tsc -p tsconfig.lib.json",

99 "build:styles": "node scripts/build-styles.js",

100 "verify:build": "node scripts/verify-build.js",

101 "copy:css": "cp src/components/debug/debug.css dist/nqui.css",

102 "build:app": "tsc -b && vite build",

103 "build:all": "npm run build:lib && npm run build:app",

104 "prepublishOnly": "npm run verify:publish",

105 "verify:publish": "node scripts/verify-publish.mjs",

106 "publish:github": "npm publish --registry=https://npm.pkg.github.com",

107 "publish:npm": "node scripts/publish-npmjs.js",

108 "publish:both": "npm run publish:github && npm run publish:npm",

109 "lint": "eslint src scripts --max-warnings 0",

110 "preview": "vite preview",

111 "preview:app": "vite preview --outDir dist-app",

112 "init-debug-css": "node scripts/init-debug-css.js",

README.mdView file

•Vite with `@tailwindcss/vite` often works without `@source`; add the block above when utilities from the package do not show up in CSS.

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Toggle between local (npm link) and published @nqlib/nqui.

4 *

5 * CUSTOMIZE before copying to consumer project:

6 * - PROJECT_NAME: Used in log messages (e.g. "client-saas", "my-app")

7 * - PUBLISHED_VERSION: Semver for published mode (e.g. "^0.5.0")

8 * - USE_LEGACY_PEER_DEPS: true if consumer uses --legacy-peer-deps

9 * - NQUI_DIR: nqui repository root (monorepo with packages/nqui, or standalone nqui repo)

10 */

11import

Lines 157-197javascript

157 try {

158 try {

159 execSync("npm unlink @nqlib/nqui", { cwd: root, stdio: "pipe" });

160 } catch {}

161

162 const linkEnv = USE_LEGACY_PEER_DEPS ? { ...process.env, NPM_CONFIG_LEGACY_PEER_DEPS: "true" } : process.env;

163 execSync("npm link @nqlib/nqui", { cwd: root, stdio: "inherit", env: linkEnv });

164 console.log("Linked @nqlib/nqui in " + PROJECT_NAME + "\n");

165 } catch (error) {

166 console.error("Failed to link @nqlib/nqui");

167 process.exit(1);

168 }

169

170 const finalStatus = checkStatus();

171 console.log("Successfully switched to LOCAL nqui");

172 console.log(" Using:", nquiDir);

173 console.log(" Version:", finalStatus.version);

174 console.log(" Symlink:", finalStatus.isLinked ? "Active" : "Not active", "\n");

175} else {

176 console.log("Unlinking local nqui...");

177 try {

178 execSync("npm unlink @nqlib/nqui", { cwd: root, stdio: "pipe" });

179 console.log("Unlinked local nqui\n");

180 } catch {

181 console.log("No local link to remove\n");

182 }

183

184 packageJson.dependencies["@nqlib/nqui"] = PUBLISHED_VERSION;

185 writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + "\n");

186 console.log("Updated package.json to published version (" + PUBLISHED_VERSION + ")");

187

188 console.log("Installing published @nqlib/nqui...");

189 const installCmd = USE_LEGACY_PEER_DEPS

190 ? `npm install @nqlib/nqui@${PUBLISHED_VERSION} --legacy-peer-deps`

191 : `npm install @nqlib/nqui@${PUBLISHED_VERSION}`;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView on unpkg · L177

192 try {

193 execSync(installCmd, { cwd: root, stdio: "inherit" });

194 console.log("Installed published @nqlib/nqui\n");

195 } catch (error) {

196 console.error("Failed to install published version. Run npm install manually.");

197 }