registry / @tangle-network/sandbox-ui / 0.85.0

@tangle-network/sandbox-ui@0.85.0

⚠ Under review

Unified UI component library for Tangle Sandbox — primitives, chat, dashboard, terminal, editor, and workspace components

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 49 file(s), 1.13 MB of source, external domains: adobe.com, braze.com, cdn.activepieces.com, cdn.simpleicons.org, clio.com, docuseal.com, drafts.csswg.org, en.wikipedia.org, example.com, github.com, graph.microsoft.com, marketo.com, ph0ny.com, pipedream.com, rippling.com, stackoverflow.com, svgl.app, weaviate.io, www.gnu.org, www.google.com, www.talkable.com, www.w3.org

Source & flagged code

4 flagged

dist/pages.jsView file

Lines 161-201javascript

161 border: "1px solid rgba(255,255,255,0.12)",

162 color: "#fff",

163 fontSize: 14,

164 fontWeight: 600,

165 textDecoration: "none",

166 transition: "background 120ms"

167 },

168 onMouseEnter: (e) => e.currentTarget.style.background = accentHover,

169 onMouseLeave: (e) => e.currentTarget.style.background = accent,

170 children: [

171 /* @__PURE__ */ jsx(TangleKnot, { size: 16 }),

172 tangleLabel

173 ]

174 }

175 ),

176 providers.length > 0 && /* @__PURE__ */ jsx("div", { style: { display: "flex", flexDirection: "column", gap: 8, marginTop: 8 }, children: providers.map((p) => /* @__PURE__ */ jsxs(

177 "button",

178 {

179 type: "button",

180 style: outlineBtn,

181 onClick: () => {

182 window.location.href = socialHref(p);

183 },

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/pages.jsView on unpkg · L181

184 onMouseEnter: (e) => e.currentTarget.style.background = "rgba(0,0,0,0.02)",

185 onMouseLeave: (e) => e.currentTarget.style.background = "transparent",

186 children: [

187 SOCIAL_ICON[p],

188 "Continue with ",

189 SOCIAL_LABEL[p]

190 ]

191 },

192 p

193 )) }),

194 onEmailSubmit && /* @__PURE__ */ jsxs(Fragment, { children: [

195 /* @__PURE__ */ jsxs("div", { style: { display: "flex", alignItems: "center", gap: 12, margin: "24px 0" }, children: [

196 /* @__PURE__ */ jsx("div", { style: { flex: 1, height: 1, background: C.border } }),

197 /* @__PURE__ */ jsx("span", { style: { fontSize: 12, color: C.muted }, children: "or" }),

198 /* @__PURE__ */ jsx("div", { style: { flex: 1, height: 1, background: C.border } })

199 ] }),

200 /* @__PURE__ */ jsxs("form", { onSubmit: handleSubmit, style: { display: "flex", flexDirection: "column", gap: 12 }, children: [

201 showName && /* @__PURE__ */ jsx("input", { type: "text", required: true, "aria-label": "Name", placeholder: "Name", autoComplete: "name", value: name, onChange: (e) => setName(e.target.value), style: inputStyle }),

Lines 3253-3293javascript

3253 DialogHeader as DialogHeader4,

3254 DialogTitle as DialogTitle4

3255} from "@tangle-network/ui/primitives";

3256import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";

3257var SCRIPT_TYPE_META

Lines 3376-3416javascript

3376 echo "SSH key configured for Git access"

3377else

3378 echo "No SSH_PRIVATE_KEY secret found, skipping"

3379fi`,

3380 injectSecrets: ["SSH_PRIVATE_KEY"]

3381 },

3382 {

3383 name: "Node.js Project Bootstrap",

3384 description: "Initialize a new Node.js project with TypeScript",

3385 scriptType: "node",

3386 content: `#

•matchType = previous_version_dangerous_delta matchedPackage = @tangle-network/sandbox-ui@0.75.0 matchedIdentity = npm:[redacted]:0.75.0 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/pages.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/pages.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code