registry / @nqlib/nqui / 0.7.2

@nqlib/nqui@0.7.2

A React component library with enhanced UI components and developer tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 76 file(s), 1.37 MB of source, external domains: bazza.dev, radix-ui.com, registry.npmjs.com, www.npmjs.com, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 72-112json

72 "type": "git",

73 "url": "git+https://github.com/nqlib/nqui.git"

74 },

75 "keywords": [

76 "ui",

77 "components",

78 "react",

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/post-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

README.mdView file

•Vite with `@tailwindcss/vite` often works without `@source`; add the block above when utilities from the package do not show up in CSS.

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView file

11import { readFileSync, writeFileSync, existsSync, lstatSync, realpathSync } from "fs"; L12: import { execSync } from "child_process"; L13: import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView on unpkg · L11

177try { L178: execSync("npm unlink @nqlib/nqui", { cwd: root, stdio: "pipe" }); L179: console.log("Unlinked local nqui\n"); ... L189: const installCmd = USE_LEGACY_PEER_DEPS L190: ? `npm install @nqlib/nqui@${PUBLISHED_VERSION} --legacy-peer-deps` L191: : `npm install @nqlib/nqui@${PUBLISHED_VERSION}`;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView on unpkg · L177

Findings

5 High2 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighAi Reviewer ManipulationREADME.md

HighChild Processdocs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.js

HighShell

HighRuntime Package Installdocs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Toggle between local (npm link) and published @nqlib/nqui.

4 *

5 * CUSTOMIZE before copying to consumer project:

6 * - PROJECT_NAME: Used in log messages (e.g. "client-saas", "my-app")

7 * - PUBLISHED_VERSION: Semver for published mode (e.g. "^0.5.0")

8 * - USE_LEGACY_PEER_DEPS: true if consumer uses --legacy-peer-deps

9 * - NQUI_DIR: nqui repository root (monorepo with packages/nqui, or standalone nqui repo)

10 */

11import { readFileSync, writeFileSync, existsSync, lstatSync, realpathSync } from "fs";

12import { execSync } from "child_process";

13import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView on unpkg · L11

14import { dirname, join, resolve } from "path";

16const __filename = fileURLToPath(import.meta.url);

17const __dirname = dirname(__filename);

18/** Consumer project root when this file lives at `<project>/scripts/toggle-nqui.js` */

19const root = resolve(__dirname, "..");

20const packageJsonPath = join(root, "package.json");

21const nodeModulesNqui = join(root, "node_modules", "@nqlib", "nqui");

23// --- CUSTOMIZE ---

24const PROJECT_NAME = "this project"; // e.g. "client-saas", "my-vite-app"

25const PUBLISHED_VERSION = "^0.5.0"; // Match latest @nqlib/nqui release

26const USE_LEGACY_PEER_DEPS = false; // Set true if project uses --legacy-peer-deps

27// --- END CUSTOMIZE ---

29const nquiBaseDir = process.env.NQUI_DIR || resolve(root, "..", "nqui");

31/** Monorepo: <repo>/packages/nqui. Standalone nqui repo: <repo> is the package root. */

Lines 157-197javascript

157 try {

158 try {

159 execSync("npm unlink @nqlib/nqui", { cwd: root, stdio: "pipe" });

160 } catch {}

161

162 const linkEnv = USE_LEGACY_PEER_DEPS ? { ...process.env, NPM_CONFIG_LEGACY_PEER_DEPS: "true" } : process.env;