registry / @underverse-ui/underverse / 1.0.188

@underverse-ui/underverse@1.0.188

⚠ Under review

Underverse UI – reusable React/Next.js UI components

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 3.46 MB of source, external domains: example.com, prosemirror.net, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 25-65json

25 "require": "./dist/index.cjs"

26 }

27 },

28 "files": [

29 "dist",

30 "README.md",

31 "CHANGELOG.md",

32 "AGENTS.md",

33 "api-reference.json",

34 "llms.txt",

35 "agent-recipes.json",

36 "emojis",

37 "scripts/copy-emojis.mjs",

38 "stickers/*/thumb/*.webp",

39 "stickers/*/display/*.webp",

40 "scripts/prepare-stickers.mjs",

41 "scripts/copy-stickers.mjs"

42 ],

43 "sideEffects": false,

44 "scripts": {

45 "postinstall": "node ./scripts/copy-emojis.mjs && node ./scripts/copy-stickers.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "dev": "tsup --config tsup.config.ts --watch",

47 "prepare:stickers": "node ./scripts/prepare-stickers.mjs",

48 "typecheck": "tsc -p tsconfig.tsup.json --noEmit --incremental false",

49 "generate:api": "node ./scripts/generate-api-reference.mjs",

50 "verify:agent-metadata": "npm run generate:api && node ./scripts/verify-agent-metadata.mjs",

51 "test:overlay-scrollbar": "node --test --experimental-strip-types ./tests/overlay-scrollbar-provider.test.mjs",

52 "test:data-table": "node --test --experimental-strip-types ./tests/data-table-sticky.test.mjs",

53 "test:data-table-deep": "node --test --experimental-strip-types ./tests/data-table-headers-validation.test.mjs",

54 "test:data-table-ui": "node --test ./tests/data-table.interaction.test.mjs",

55 "test:combobox-large-options": "node --test ./tests/combobox-large-options.test.mjs",

56 "test:category-tree-select-ui": "node --test ./tests/category-tree-select.interaction.test.mjs",

57 "test:calendar-timeline": "node --test --experimental-strip-types ./tests/calendar-timeline-model.test.mjs",

58 "test:calendar-timeline-deep": "node --test --experimental-strip-types ./tests/calendar-timeline-date-layout.test.mjs",

59 "test:calendar-timeline-ui": "node --test ./tests/calendar-timeline.interaction.test.mjs",

60 "test:ueditor-clipboard": "node --test --experimental-strip-types ./tests/ueditor-clipboard-tables.test.mjs",

61 "test:ueditor-deep": "node --test --experimental-strip-types ./tests/ueditor-prepare-content.test.mjs",

62 "test:ueditor-form-fields": "node --test --experimental-strip-types ./tests/ueditor-form-fields.test.mjs",

63 "test:ueditor-formula": "node --test --experimental-strip-types ./tests/ueditor-table-formula.test.mjs",

64 "test:ueditor-ui": "node --test ./tests/ueditor.interaction.test.mjs",

65 "test:public-api": "node --test ./tests/public-api-smoke.test.mjs",

dist/index.jsView file

38165contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L38165

dist/index.cjsView file

•Trigger-reachable chain: manifest.main -> dist/index.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/copy-emojis.mjs && node ./scripts/copy-stickers.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/copy-emojis.mjs && node ./scripts/copy-stickers.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

38165contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L38165

dist/index.cjsView file

•Trigger-reachable chain: manifest.main -> dist/index.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg

Findings

2 Critical1 High3 Medium6 Low

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings