registry / @tmf_ciclica/ciclicastorybook / 1.2.161

@tmf_ciclica/ciclicastorybook@1.2.161

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The exported `PercentageBar` evaluates a string formula supplied in item data at render time. No install-time mutation, persistence, or exfiltration behavior was confirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

A consuming application renders `PercentageBar` with an attacker-controlled `items[].translationFormula`.

Impact

Arbitrary JavaScript execution in the consuming application's browser origin.

Mechanism

Runtime dynamic JavaScript evaluation via `new Function`.

Rationale

This is a concrete browser-side code-injection capability exposed through a string prop, but the inspected source does not show malicious install-time or exfiltration behavior. Downgrade to warn for the vulnerability rather than blocking it as malware.

Evidence

dist/index.es.jsdist/index.cjs.jspackage.jsonREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`dist/index.es.js` evaluates `translationFormula` with `new Function`.
`PercentageBar` accepts `items[].translationFormula` as a string and invokes the evaluator during render.
A controlling application that passes untrusted item data can cause arbitrary JavaScript in its browser origin.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` hook.
No child-process, filesystem, credential-harvesting, or agent-control-surface code was found.
No `fetch`, XHR, WebSocket, or beacon use was found in the bundled ESM entrypoint.
Mapbox token reads and the default Mapbox RTL-plugin URL are map-component configuration, not exfiltration.

Behavioral surface

Source

ChildProcessEnvironmentVarsEval

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 2 file(s), 817 KB of source, external domains: api.mapbox.com, fb.me, fonts.googleapis.com, mui.com, unpkg.com, v7.mui.com, www.w3.org

Source & flagged code

3 flagged

dist/index.cjs.jsView file

Lines 60-84javascript

60Did you intend to use one of the following approaches?

62import { green } from "@mui/material/colors";

64const theme1 = createTheme({ palette: {

65 primary: green,

66} });

68const theme2 = createTheme({ palette: {

69 primary: { main: green[500] },

70} });`:jt(12,_?` (${_})`:"",JSON.stringify(x.main)));return o?(is(o,x,"light",E,r),is(o,x,"dark",C,r)):(ss(x,"light",E,r),ss(x,"dark",C,r)),x.contrastText||(x.contrastText=y(x.main)),x};let b;return t==="light"?b=wi():t==="dark"&&(b=Ti()),process.env.NODE_ENV!=="production"&&(b||console.error(`MUI: The palette mode \`${t}\` is not supported.`)),qe({common:{...cn},mode:t,primary:h({color:a,name:"primary"}),secondary:h({color:c,name:"secondary",mainShade:"A400",lightShade:"A200",darkShade:"A700"}),error:

71`)),Object.keys(d).length!==0&&console.error(`MUI: Unrecognized argument(s) [${Object.keys(d).join(",")}].`)}return(Array.isArray(o)?o:[o]).map(m=>`${m} ${typeof a=="string"?a:cs(a)} ${c} ${typeof u=="string"?u:cs(u)}`).join(",")},...e,easing:t,duration:n}}const Bu={mobileStepper:1e3,fab:1050,speedDial:1050,appBar:1100,drawer:1200,modal:1300,snackbar:1400,tooltip:1500};function Pu(e){return it(e)||typeof e>"u"||typeof e=="string"||typeof e=="boolean"||typeof e=="number"||Array.isArray(e)}function ki(e={}){const t={...e};function n(r){const o=Object.entries(r);for(let i=0;i<o.length;i++){const[ ...

73const theme = ${JSON.stringify(t,null,2)};

75theme.breakpoints = createBreakpoints(theme.breakpoints || {});

76theme.transitions = createTransitions(theme.transitions || {});

78export default theme;`}function us(e){return typeof e=="number"?`${(e*100).toFixed(0)}%`:`calc((${e}) * 100%)`}const Vu=e=>{

79`))}x[S]={}}}};Object.keys(h.components).forEach(x=>{const _=h.components[x].styleOverrides;_&&x.startsWith("Mui")&&f(_,x)})}return h.unstable_sxConfig={...Qn,...m==null?void 0:m.unstable_sxConfig},h.unstable_sx=function(f){return Ut({sx:f,theme:this})},h.toRuntimeSource=ki,Fu(h),h}function zu(e){let t;return e<1?t=5.11916*e**2:t=4.5*Math.log(e+1)+2,Math.round(t*10)/1e3}const qu=[...Array(25)].map((e,t)=>{if(t===0)return"none";const n=zu(t);return`linear-gradient(rgba(255 255 255 / ${n}), rgba(255 255 255 / ${

80To suppress this warning, you need to explicitly provide the \`palette.${t}Channel\` as a string (in rgb format, for example "12 12 12") or undefined if you want to remove the channel token.`))}function Gu(e){return typeof e=="number"?`${e}px`:typeof e=="string"||typeof e=="function"||Array.isArray(e)?e:"8px"}const Ye=e=>{try{return e()}catch{}},Yu=(e="mui")=>pu(e);function _r(e,t,n,r,o){if(!n)return;n=n===!0?{}:n;const i=o==="dark"?"dark":"light";if(!r){t[o]=Wu({...n,palette:{mode:i,...n==null?void 0:n.palette},colorSpace:e});return}const{palette:a,...c}=Dr({...r,palette:{mode:i,...n==null?vo ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjs.jsView on unpkg · L80

81 ${o?st.active:""}

82 ${i?st.completed:""}`,style:o?{backgroundColor:t}:{},onClick:n.onClick,children:r+1}),r<e.length-1&&l.jsx("div",{className:st.connector})]}),l.jsx("div",{className:`${st.label} ${o?

83 ${o&&On.active}`,children:l.jsx("span",{className:On.buttonName,children:t(i)})})},r)})})};Zi.propTypes={buttons:s.arrayOf(s.shape({isActive:s.bool,name:s.string,onClick:s.func})).isRequired};const Cf="_switchContainer_194wl_2",_f="_labelRight_194wl_9",wf="_labelLeft_194wl_9",Sf="_slider_194wl_28",Tf="_disabled_194wl_54",Ft={switchContainer:Cf,labelRight:_f,labelLeft:wf,switch:"_switch_194wl_2",slider:Sf,disabled:Tf},Hi=({input:e,reactHookFormInstance:t,onChange:n,onoff:r=!0})=>{const{code:o,labelLeft:i,labelRight:a,defValue:c=!1,colorOn:u="#5A514D",disabled:d=!1,width:m=240}=e ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.cjs.jsView on unpkg · L82

Long lines were clipped for display.

dist/index.es.jsView file

Lines 9370-9410javascript

9370 })

9371 }),

9372 buttonContainerStyles: i.object,

9373 containerStyles: i.object,

9374 onCLickNewElement: i.func,

9375 moreInfo: i.shape({

9376 label: i.string,

9377

Source & flagged code

3 flagged · loading source

dist/index.cjs.jsView file

80patternName = generic_password severity = medium line = 80 matchedText = To suppr...cle}

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjs.jsView on unpkg · L80

82${i?st.completed:""}`,style:o?{backgroundColor:t}:{},onClick:n.onClick,children:r+1}),r<e.length-1&&l.jsx("div",{className:st.connector})]}),l.jsx("div",{className:`${st.label} ${o... L83: ${o&&On.active}`,children:l.jsx("span",{className:On.buttonName,children:t(i)})})},r)})})};Zi.propTypes={buttons:s.arrayOf(s.shape({isActive:s.bool,name:s.string,onClick:s.func}))....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.cjs.jsView on unpkg · L82

dist/index.es.jsView file

9390patternName = generic_password severity = medium line = 9390 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.es.js

dist/index.es.jsView on unpkg · L9390

Findings

3 Medium6 Low

MediumSecret Patterndist/index.cjs.js

MediumEnvironment Vars

MediumSecret Patterndist/index.es.js

LowScripts Present

LowEvaldist/index.cjs.js

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.cjs.jsView file

Lines 60-84javascript

60Did you intend to use one of the following approaches?

62import { green } from "@mui/material/colors";

64const theme1 = createTheme({ palette: {

65 primary: green,

66} });

68const theme2 = createTheme({ palette: {

69 primary: { main: green[500] },

73const theme = ${JSON.stringify(t,null,2)};

75theme.breakpoints = createBreakpoints(theme.breakpoints || {});

76theme.transitions = createTransitions(theme.transitions || {});

78export default theme;`}function us(e){return typeof e=="number"?`${(e*100).toFixed(0)}%`:`calc((${e}) * 100%)`}const Vu=e=>{

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjs.jsView on unpkg · L80

81 ${o?st.active:""}

82 ${i?st.completed:""}`,style:o?{backgroundColor:t}:{},onClick:n.onClick,children:r+1}),r<e.length-1&&l.jsx("div",{className:st.connector})]}),l.jsx("div",{className:`${st.label} ${o?

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.cjs.jsView on unpkg · L82

Long lines were clipped for display.

dist/index.es.jsView file

Lines 9370-9410javascript

9370 })

9371 }),

9372 buttonContainerStyles: i.object,

9373 containerStyles: i.object,

9374 onCLickNewElement: i.func,

9375 moreInfo: i.shape({

9376 label: i.string,

9377