registry / @peers-app/peers-ui / 0.21.0

@peers-app/peers-ui@0.21.0

React components and hooks for building [Peers](https://peers.app) package UIs.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

At application runtime, this UI framework retrieves bundle code for enabled Peers packages and evaluates it in the host page context. This is an unsandboxed extension-code execution surface, but no evidence shows this package itself delivers a malicious payload.

Static reason

No blocking static signals were detected.

Trigger

Mounting the Peers UI/runtime while enabled packages have active package versions.

Impact

A party able to control an active package bundle can execute JavaScript with the host application's browser privileges.

Mechanism

SDK RPC bundle retrieval followed by `new Function` evaluation.

Rationale

The package is not shown to be malicious, but it implements an unsandboxed automatic package-bundle execution capability. Downgrade to warn because the capability creates a material remote-code-execution surface if active bundle content is compromised.

Evidence

src/ui-router/routes-loader.tssrc/ui-router/ui-loader.tsxREADME.mdpackage.json.claude/settings.local.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`src/ui-router/routes-loader.ts` fetches active-package route bundle text through SDK RPC.

@peers-app/peers-ui@0.21.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code