registry / @nqlib/nqui / 0.7.8

@nqlib/nqui@0.7.8

⚠ Under review

A React component library with enhanced UI components and developer tools

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 80 file(s), 1.47 MB of source, external domains: bazza.dev, radix-ui.com, registry.npmjs.com, www.npmjs.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 77-117json

77 "type": "git",

78 "url": "git+https://github.com/nqlib/nqui.git"

79 },

80 "keywords": [

81 "ui",

82 "components",

83 "react",

84 "typescript",

85 "nextjs",

86 "vite",

87 "tailwind",

88 "shadcn",

89 "radix-ui"

90 ],

91 "author": "",

92 "license": "MIT",

93 "engines": {

94 "node": ">=20"

95 },

96 "scripts": {

97 "postinstall": "node scripts/post-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L97

98 "dev": "node scripts/dev-catalog-pointer.js",

99 "sync:skills": "node scripts/sync-consumer-skills.mjs",

100 "skill:validate": "node scripts/validate-skills.mjs",

101 "product:lint": "node scripts/lint-product-docs.mjs",

102 "build": "npm run sync:skills && npm run build:lib",

103 "build:lib": "vite build --mode library && npm run build:types && npm run build:styles && npm run verify:build && npm run copy:css",

104 "build:types": "tsc -p tsconfig.lib.json",

105 "build:styles": "node scripts/build-styles.js",

106 "verify:build": "node scripts/verify-build.js",

107 "copy:css": "cp src/components/debug/debug.css dist/nqui.css",

108 "build:app": "node scripts/dev-catalog-pointer.js",

109 "build:all": "npm run build:lib",

110 "prepublishOnly": "npm run verify:publish",

111 "verify:publish": "node scripts/verify-publish.mjs",

112 "publish:github": "npm publish --registry=https://npm.pkg.github.com",

113 "publish:npm": "node scripts/publish-npmjs.js",

114 "publish:both": "npm run publish:github && npm run publish:npm",

115 "lint": "eslint src scripts --max-warnings 0",

116 "preview": "vite preview",

117 "init-debug-css": "node scripts/init-debug-css.js",

README.mdView file

•Vite with `@tailwindcss/vite` often works without `@source`; add the block above when utilities from the package do not show up in CSS.

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

docs/nqui-skills/nqui-local-published-toggle/scripts/toggle-nqui.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Toggle between local (npm link) and published @nqlib/nqui.

4 *

5 * CUSTOMIZE before copying to consumer project:

6 * - PROJECT_NAME: Used in log messages (e.g. "client-saas", "my-app")

7 * - PUBLISHED_VERSION: Semver for published mode (e.g. "^0.5.0")

8 * - USE_LEGACY_PEER_DEPS: true if consumer uses --legacy-peer-deps

9 * - NQUI_DIR: nqui repository root (monorepo with packages/nqui, or standalone nqui repo)

scripts/post-install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3/**

4 * Post-install: print next steps for nqui setup.

5 * Runs after npm/pnpm/yarn install. Also invokable via: npx nqui-setup

6 *

7 * Auto-injects Cursor rules so consumers don't need to remember init-cursor.

8 */

10import { existsSync, readFileSync, writeFileSync } from 'fs';

scripts/init-cursor.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: mport { resolve, dirname, relative } from 'path'; import { fileurltopath } from 'url'; import { full_peer_list } from './peer-deps.js'; import { buildcursorrule } from './sk[redacted]'; import { resolvetargetdir } from './resolve-target-dir.js'; import { downloadskills } from './download-skills.js'; const __dirname = dirname(fileurltopath(import.meta.url)); const cwd = process.cwd(); export function writecursorrule(targetcwd) { const cursordir = resolve(targetcwd, '.cursor'); const rulesdir = resolve(cursordir, 'rules'); if (!existssync(cursordir)) mkdirsync(cursordir, { recursive: true }); if (!existssync(rulesdir)) mkdirsync(rulesdir, { recursive: true }); writefilesync(resolve(rulesd

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/init-cursor.jsView on unpkg

scripts/install-claude-skills.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node import { cpsync, existssync, mkdirsync, readdirsync, readfilesync, statsync, writefilesync } from 'fs'; import { homedir } from 'os'; import { join } from 'path'; import { getpackageroot } from './getpackageroot.js'; const root = getpackageroot(); const skills_source = join(root, 'docs', 'nqui-skills'); const components_source = join(root, 'docs', '

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-claude-skills.jsView on unpkg

scripts/install-peers.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * Installs @nqlib/nqui + all required and optional peer dependencies.

5 * Use when you want full library support (Sortable, Carousel, DataTable, etc.).

6 *

7 * Usage: npx @nqlib/nqui install-peers

8 */

10import { existsSync } from 'fs';

scripts/publish-npmjs.jsView file

•matchType = normalized_sha256 matchedPackage = @nqlib/nqui@0.7.7 matchedPath = scripts/publish-npmjs.js matchedIdentity = npm:QG5xbGliL25xdWk:0.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/publish-npmjs.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code