registry / @trii/components / 2.0.100

@trii/components@2.0.100

Trii components package

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network behavior is package-aligned UI/API integration for Trii contacts, calendar, theme, media upload, and Google Maps features.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing and using exported React components or dispatching updateTheme in a consumer app.

Impact

Expected application API calls; no evidence of unconsented install-time execution, credential theft, or destructive behavior.

Mechanism

User-invoked UI API requests and Google Maps script loading

Rationale

Static inspection shows suspicious scanner hits are explained by a normal React component package with user-invoked fetch/axios calls and Google Maps support. There is no lifecycle execution, exfiltration, persistence, destructive action, or AI-agent control mutation.

Evidence

package.jsondist/esm/index.jsdist/cjs/index.jsdist/esm/index.js.mapdist/types/components/EventsDialog/utils/googleMapsLoader.d.ts

Network endpoints3

agent-api.trii.app/api/v1/settings/user/setThememaps.googleapis.com/maps/api/jsmaps.googleapis.com/maps/api/staticmap

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/esm/index.js.map contains a hardcoded Google Maps browser API key used for map script/static map URLs.
dist/esm/index.js.map themeSlice posts selected theme and uid to https://agent-api.trii.app/api/v1/settings/user/setTheme when updateTheme is invoked.

Evidence against

package.json has no preinstall/install/postinstall/prepare lifecycle hooks or bin entries.
main/module are dist/cjs/index.js and dist/esm/index.js, a React/MUI component bundle exporting UI components and theme helpers.
Network calls are user/runtime UI APIs built from caller-supplied baseUrl/spaceId for contacts, media, settings, and calendar operations.
No child_process, filesystem writes, native binary/wasm loading, eval, persistence, or AI-agent control-surface writes found.
Google Maps key is used client-side for package-aligned map/geocoding UI, not credential harvesting or exfiltration.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 471 KB of source, external domains: agent-api.trii.app, github.com, maps.googleapis.com, reactjs.org

Source & flagged code

3 flagged

dist/esm/index.jsView file

Lines 1-18javascript

1import Pn,{useCallback as ie,useEffect as Y,createContext as It,useContext as xt,useRef as xe,useState as v,useMemo as ne,createElement as Rn,useDeferredValue as Di}from"react";import{styled as ee,Box as C,IconButton as me,Avatar as Sa,Typography as _,CircularProgress as Ke,Tooltip as vt,Chip as kt,Popper as zn,ClickAwayListener as Bn,CardContent as on,Stack as at,LinearProgress as On,Autocomplete as Ia,TextField as je,Button as Ae,Divider as Ln,Popover as Fi,Select as Jt,MenuItem as ct,FormControl as ka,Card as Ea,InputLabel as $i,Menu as Ui,ListItemIcon as Ta,ListItemText as Aa,Modal as Xt,G ...

2`+fe+p}}var ke=!1,Fe;{var K=typeof WeakMap=="function"?WeakMap:Map;Fe=new K}function le(p,z){if(!p||ke)return"";{var G=Fe.get(p);if(G!==void 0)return G}var re;ke=!0;var pe=Error.prepareStackTrace;Error.prepareStackTrace=void 0;var be;be=Ie.current,Ie.current=null,U();try{if(z){var ce=function(){throw Error()};if(Object.defineProperty(ce.prototype,"props",{set:function(){throw Error()}}),typeof Reflect=="object"&&Reflect.construct){try{Reflect.construct(ce,[])}catch(Ye){re=Ye}Reflect.construct(p,[],ce)}else{try{ce.call()}catch(Ye){re=Ye}p.call(ce.prototype)}}else{try{throw Error()}catch(Ye){re= ...

3`),Le=re.stack.split(`

4`),Ee=de.length-1,Te=Le.length-1;Ee>=1&&Te>=0&&de[Ee]!==Le[Te];)Te--;for(;Ee>=1&&Te>=0;Ee--,Te--)if(de[Ee]!==Le[Te]){if(Ee!==1||Te!==1)do if(Ee--,Te--,Te<0||de[Ee]!==Le[Te]){var tt=`

5`+de[Ee].replace(" at new "," at ");return p.displayName&&tt.includes("<anonymous>")&&(tt=tt.replace("<anonymous>",p.displayName)),typeof p=="function"&&Fe.set(p,tt),tt}while(Ee>=1&&Te>=0);break}}}finally{ke=!1,Ie.current=be,J(),Error.prepareStackTrace=pe}var yt=p?p.displayName||p.name:"",dt=yt?Ce(yt):"";return typeof p=="function"&&Fe.set(p,dt),dt}function $e(p,z,G){return le(p,!1)}function ze(p){var z=p.prototype;return!!(z&&z.isReactComponent)}function nt(p,z,G){if(p==null)return"";if(typeof p=="function")return le(p,ze(p));if(typeof p=="string")return Ce(p);switch(p){case c:return Ce("Susp ...

7Check the render method of \``+p+"`."}return""}}function Ht(p){{if(p!==void 0){var z=p.fileName.replace(/^.*[\\\/]/,""),G=p.lineNumber;return`

9Check your code at `+z+":"+G+"."}return""}}var ja={};function gt(p){{var z=Dt();if(!z){var G=typeof p=="string"?p:p.displayName||p.name;G&&(z=`

11Check the top-level render call using <`+G+">.")}return z}}function Gt(p,z){{if(!p._store||p._store.validated||p.key!=null)return;p._store.validated=!0;var G=gt(z);if(ja[G])return;ja[G]=!0;var re="";p&&p._owner&&p._owner!==jt.current&&(re=" It was passed a child from "+H(p._owner.type)+"."),mt(p),S('Each child in a list should have a unique "key" prop.%s%s See https://reactjs.org/link/warning-keys for more information.',G,re),mt(null)}}function ht(p,z){{if(typeof p!="object")return;if(ot(p))for(var G=0;G<p.length;G++){var re=p[G];wt(re)&&Gt(re,z)}else if(wt(p))p._store&&(p._store.validated=!0) ...

12 let props = %s;

13 <%s {...props} />

14React keys must be passed directly to JSX without using spread:

15 let props = %s;

16 <%s key={someKey} {...props} />`,qt,dt,rn,dt),bt[dt+qt]=!0}}return p===r?Ft(Te):tn(Te),Te}}function Yt(p,z,G){return Bt(p,z,G,!0)}function Kt(p,z,G){return Bt(p,z,G,!1)}var an=Kt,nn=Yt;ia.Fragment=r,ia.jsx=an,ia.jsxs=nn})()),ia}process.env.NODE_ENV==="production"?hn.exports=Rs():hn.exports=zs();var t=hn.exports;Ps(t);const Bs=ee(C)(({theme:e})=>({position:"absolute",top:8,right:8,display:"flex",flexDirection:"column",gap:4,zIndex:1,backgroundColor:e.palette.background.panel})),ar=ee(me)({padding:4}),Os=ee(C)({display:"flex",flexDirection:"column",alignItems:"center",marginBottom:"16px",posit ...

High

High Secret

Package contains a high-severity secret pattern.

dist/esm/index.jsView on unpkg · L16

High

Secret Pattern

Google API key in dist/esm/index.js

dist/esm/index.jsView on unpkg · L16

17//# sourceMappingURL=index.js.map

Long lines were clipped for display.

dist/cjs/index.jsView file

Lines 1-18javascript

1"use strict";var l=require("react"),s=require("@mui/material"),Me=require("@mui/icons-material"),Ur=require("@mui/icons-material/ArrowForward"),Rr=require("@mui/icons-material/Message"),Je=require("react-i18next"),K=require("@trii/types/dist/Contacts"),xt

Source & flagged code

3 flagged · loading source

dist/esm/index.jsView file

16patternName = google_api_key severity = high line = 16 matchedText = <%s key=...me};

High

High Secret

Package contains a high-severity secret pattern.

dist/esm/index.jsView on unpkg · L16

16patternName = google_api_key severity = high line = 16 matchedText = <%s key=...me};

High

Secret Pattern

Google API key in dist/esm/index.js

dist/esm/index.jsView on unpkg · L16

dist/cjs/index.jsView file

16patternName = google_api_key severity = high line = 16 matchedText = <%s key=...=wr;

High

Secret Pattern

Google API key in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L16

Findings

3 High2 Medium3 Low

HighHigh Secretdist/esm/index.js

HighSecret Patterndist/esm/index.js

HighSecret Patterndist/cjs/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/esm/index.jsView file

Lines 1-18javascript

3`),Le=re.stack.split(`

4`),Ee=de.length-1,Te=Le.length-1;Ee>=1&&Te>=0&&de[Ee]!==Le[Te];)Te--;for(;Ee>=1&&Te>=0;Ee--,Te--)if(de[Ee]!==Le[Te]){if(Ee!==1||Te!==1)do if(Ee--,Te--,Te<0||de[Ee]!==Le[Te]){var tt=`

7Check the render method of \``+p+"`."}return""}}function Ht(p){{if(p!==void 0){var z=p.fileName.replace(/^.*[\\\/]/,""),G=p.lineNumber;return`

9Check your code at `+z+":"+G+"."}return""}}var ja={};function gt(p){{var z=Dt();if(!z){var G=typeof p=="string"?p:p.displayName||p.name;G&&(z=`

12 let props = %s;

13 <%s {...props} />

14React keys must be passed directly to JSX without using spread:

15 let props = %s;

High

High Secret

Package contains a high-severity secret pattern.

dist/esm/index.jsView on unpkg · L16

High

Secret Pattern

Google API key in dist/esm/index.js

dist/esm/index.jsView on unpkg · L16

17//# sourceMappingURL=index.js.map

Long lines were clipped for display.

dist/cjs/index.jsView file

Lines 1-18javascript