registry / @tangle-network/sandbox-ui / 0.76.0

@tangle-network/sandbox-ui@0.76.0

⚠ Under review

Unified UI component library for Tangle Sandbox — primitives, chat, dashboard, terminal, editor, and workspace components

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 47 file(s), 1.09 MB of source, external domains: adobe.com, braze.com, cdn.activepieces.com, cdn.simpleicons.org, clio.com, docuseal.com, drafts.csswg.org, en.wikipedia.org, example.com, github.com, graph.microsoft.com, marketo.com, ph0ny.com, pipedream.com, rippling.com, stackoverflow.com, svgl.app, weaviate.io, www.gnu.org, www.google.com, www.talkable.com, www.w3.org

Source & flagged code

4 flagged

dist/pages.jsView file

Lines 160-200javascript

160 border: "1px solid rgba(255,255,255,0.12)",

161 color: "#fff",

162 fontSize: 14,

163 fontWeight: 600,

164 textDecoration: "none",

165 transition: "background 120ms"

166 },

167 onMouseEnter: (e) => e.currentTarget.style.background = accentHover,

168 onMouseLeave: (e) => e.currentTarget.style.background = accent,

169 children: [

170 /* @__PURE__ */ jsx(TangleKnot, { size: 16 }),

171 tangleLabel

172 ]

173 }

174 ),

175 providers.length > 0 && /* @__PURE__ */ jsx("div", { style: { display: "flex", flexDirection: "column", gap: 8, marginTop: 8 }, children: providers.map((p) => /* @__PURE__ */ jsxs(

176 "button",

177 {

178 type: "button",

179 style: outlineBtn,

180 onClick: () => {

181 window.location.href = socialHref(p);

182 },

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/pages.jsView on unpkg · L180

183 onMouseEnter: (e) => e.currentTarget.style.background = "rgba(0,0,0,0.02)",

184 onMouseLeave: (e) => e.currentTarget.style.background = "transparent",

185 children: [

186 SOCIAL_ICON[p],

187 "Continue with ",

188 SOCIAL_LABEL[p]

189 ]

190 },

191 p

192 )) }),

193 onEmailSubmit && /* @__PURE__ */ jsxs(Fragment, { children: [

194 /* @__PURE__ */ jsxs("div", { style: { display: "flex", alignItems: "center", gap: 12, margin: "24px 0" }, children: [

195 /* @__PURE__ */ jsx("div", { style: { flex: 1, height: 1, background: C.border } }),

196 /* @__PURE__ */ jsx("span", { style: { fontSize: 12, color: C.muted }, children: "or" }),

197 /* @__PURE__ */ jsx("div", { style: { flex: 1, height: 1, background: C.border } })

198 ] }),

199 /* @__PURE__ */ jsxs("form", { onSubmit: handleSubmit, style: { display: "flex", flexDirection: "column", gap: 12 }, children: [

200 showName && /* @__PURE__ */ jsx("input", { type: "text", required: true, "aria-label": "Name", placeholder: "Name", autoComplete: "name", value: name, onChange: (e) => setName(e.target.value), style: inputStyle }),

Lines 3252-3292javascript

3252 DialogHeader as DialogHeader4,

3253 DialogTitle as DialogTitle4

3254} from "@tangle-network/ui/primitives";

3255import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";

3256var SCRIPT_TYPE_META

Lines 3375-3415javascript

3375 echo "SSH key configured for Git access"

3376else

3377 echo "No SSH_PRIVATE_KEY secret found, skipping"

3378fi`,

3379 injectSecrets: ["SSH_PRIVATE_KEY"]

3380 },

3381 {

3382 name: "Node.js Project Bootstrap",

3383 description: "Initialize a new Node.js project with TypeScript",

3384 scriptType: "node",

3385 content: `#

dist/chunk-UEMWLVVY.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tangle-network/sandbox-ui@0.75.0 matchedIdentity = npm:[redacted]:0.75.0 similarity = 0.956 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-UEMWLVVY.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/pages.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code