registry / @servicetitan/json-render-react / 0.4.1

@servicetitan/json-render-react@0.4.1

Generative UI catalog, registry, and renderers for json-render

AI Security Review

scanned 26d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a React JSON-spec renderer; its default action handlers are no-ops.

Static reason

No blocking static signals were detected.

Trigger

Consumer imports renderer or user interacts with rendered UI.

Impact

No package-originated credential collection, persistence, command execution, or network exfiltration established.

Mechanism

Local UI rendering, validation, and host-delegated event emission.

Rationale

Direct inspection shows a distributed React renderer with no install-time execution or concrete malicious behavior. Environment-variable references only control development versus production rendering diagnostics.

Evidence

package.jsondist/index.jsdist/index.d.tsREADME.md

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no lifecycle hooks or bin entry.
dist/index.js imports React/UI libraries and exports renderers/catalog utilities.
No fetch, XHR, WebSocket, shell, filesystem, eval, or dynamic-loading APIs found in distributed code.

@servicetitan/json-render-react@0.4.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code