registry / @weareconceptstudio/design-inspector / 0.0.5

@weareconceptstudio/design-inspector@0.0.5

Concept Studio Design Inspector

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Explicitly exported Next.js handlers expose broad-CORS, unauthenticated project-file read/write functionality. No install-time execution or credential exfiltration was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A developer exports either supplied Next.js route handler and a remote origin sends GET/POST requests.

Impact

A reachable handler can modify JSON files such as the host project's `package.json`, or CSS variables and override data, within `process.cwd()`.

Mechanism

Broad-CORS runtime file mutation through project-relative request paths.

Rationale

Source inspection found a concrete, externally triggerable file-write capability when the documented route handlers are deployed, with wildcard CORS and no authentication. It is package-aligned design-inspector functionality but unsafe enough to warn rather than block.

Evidence

package.jsondist/create-global-variables-fetch-rewriter.jsdist/next/route-handler.jsdist/next/translations-route-handler.jsdist/server/apply-translation-changes-to-file.jsdist/server/variable-overrides.jsprocess.cwd()/design-inspector-overrides.jsonprocess.cwd()/<relativePath>

Network endpoints1

/rewrite-global-variables

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

`dist/next/route-handler.js` exposes unauthenticated POST writes with `Access-Control-Allow-Origin: *`.
`dist/next/translations-route-handler.js` reads and rewrites any project-relative JSON path without an extension allowlist.
Translation writes can target `process.cwd()/package.json` and replace nested string values.
`dist/server/variable-overrides.js` writes `design-inspector-overrides.json` under an env-selected or current-workdir root.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
Package code contains no child-process, eval, dynamic loader, binary, or external-host network behavior.
Path resolution rejects absolute paths and `..` traversal; source writes are user-enabled by explicitly exporting route handlers.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 183 KB of source

Source & flagged code

4 flagged

dist/InspectorProvider.jsView file

Lines 1-30javascript

1'use client';

2import React, { useEffect, useState } from 'react';

3import { useInspector, useBroadcastSync } from './hooks';

4import useInspectorStore from './store/useInspectorStore';

5import { InspectorOverlay, VariablesRewriterOverlay, ServerChangesPanel, DevicePreview, InspectorAuth, FullPageInspector, checkInspectorAuth, clearInspectorAuth, } from './components';

6import { createGlobalVariablesFetchRewriter } from './create-global-variables-fetch-rewriter';

7import { buildInspectorMediaBreakpoints } from './media-tiers';

8import { extractCssCustomPropertyNamesFromText } from './utils';

9import './design-inspector-ui.css';

10export const InspectorProvider = ({ variableCssSource, rewriteGlobalVariable, fileRewriteApiRoute, fileRewriteDevServerUrl, fileRewriteRelativePath, variableMediaBreakpoints, mediaTiers, mediaQuery, baseMinWidthThemeKey, baseGlobalLabel, inspectorBaseMinPx, authCredentials = { login: 'design', password: 'inspector' }, pageInspector, }) => {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/InspectorProvider.js

11 useInspector();

12 useBroadcastSync();

13 const [inIframe, setInIframe] = useState(false);

14 const [isAuthed, setIsAuthed] = useState(false);

15 const [isPageInspectorPath, setIsPageInspectorPath] = useState(false);

16 const [isTranslationInspectorPath, setIsTranslationInspectorPath] = useState(false);

17 useEffect(() => {

18 setInIframe(window !== window.top);

19 setIsAuthed(checkInspectorAuth());

20 setIsTranslationInspectorPath(window.location.pathname.includes('/translation-inspector'));

21 if (pageInspector) {

22 const slug = typeof pageInspector === 'string' ? pageInspector : 'design-inspector';

23 setIsPageInspectorPath(window.location.pathname.includes(`/${slug}`));

24 }

25 }, [pageInspector]);

26 useEffect(() => {

27 const names = variableCssSource?.trim()

28 ? extractCssCustomPropertyNamesFromText(variableCssSource)

29 : null;

30 useInspectorStore.getState().setFileVariableNames(names);

dist/components/TranslationInspectorPage/index.jsView file

Lines 1-27javascript

1'use client';

2import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';

3import { createPortal } from 'react-dom';

4import { tlDbRead, tlDbWrite } from '../../utils/translation-indexed-db';

5import './style.css';

6const TI_AUTH_KEY

dist/components/TranslationInspectorPage/index.d.tsView file

Lines 1-19typescript

1import React from 'react';

2import './style.css';

3export type TranslationLangConfig = {

4 code: string;

5 /** Project-relative path, e.g. `src/translations/en.json` */

6 relativePath

dist/InspectorProvider.d.tsView file

Lines 1-33typescript

1import React from 'react';

2import type { InspectorMediaTierSpec, InspectorRewriteGlobalVariableFn, InspectorVariableMediaBreakpoint } from './types';

3import './design-inspector-ui.css';

4export interface InspectorProviderProps {

5 variableCssSource?: string;

Source & flagged code

4 flagged · loading source

dist/InspectorProvider.jsView file

10patternName = generic_password severity = medium line = 10 matchedText = export c...=> {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/InspectorProvider.jsView on unpkg · L10

dist/components/TranslationInspectorPage/index.jsView file

7patternName = generic_password severity = medium line = 7 matchedText = const DE...' };

Medium

Secret Pattern

Hardcoded password in dist/components/TranslationInspectorPage/index.js

dist/components/TranslationInspectorPage/index.jsView on unpkg · L7

dist/components/TranslationInspectorPage/index.d.tsView file

12patternName = generic_password severity = medium line = 12 matchedText = /** Auth...' */

Medium

Secret Pattern

Hardcoded password in dist/components/TranslationInspectorPage/index.d.ts

dist/components/TranslationInspectorPage/index.d.tsView on unpkg · L12

dist/InspectorProvider.d.tsView file

21patternName = generic_password severity = medium line = 21 matchedText = /** Auth...' */

Medium

Secret Pattern

Hardcoded password in dist/InspectorProvider.d.ts

dist/InspectorProvider.d.tsView on unpkg · L21

Findings

6 Medium3 Low

MediumSecret Patterndist/InspectorProvider.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/components/TranslationInspectorPage/index.js

MediumSecret Patterndist/components/TranslationInspectorPage/index.d.ts

MediumSecret Patterndist/InspectorProvider.d.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/InspectorProvider.jsView file

Lines 1-30javascript

1'use client';

2import React, { useEffect, useState } from 'react';

3import { useInspector, useBroadcastSync } from './hooks';

4import useInspectorStore from './store/useInspectorStore';

5import { InspectorOverlay, VariablesRewriterOverlay, ServerChangesPanel, DevicePreview, InspectorAuth, FullPageInspector, checkInspectorAuth, clearInspectorAuth, } from './components';

6import { createGlobalVariablesFetchRewriter } from './create-global-variables-fetch-rewriter';

7import { buildInspectorMediaBreakpoints } from './media-tiers';

8import { extractCssCustomPropertyNamesFromText } from './utils';

9import './design-inspector-ui.css';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/InspectorProvider.js

11 useInspector();

12 useBroadcastSync();

13 const [inIframe, setInIframe] = useState(false);

14 const [isAuthed, setIsAuthed] = useState(false);

15 const [isPageInspectorPath, setIsPageInspectorPath] = useState(false);

16 const [isTranslationInspectorPath, setIsTranslationInspectorPath] = useState(false);

17 useEffect(() => {

18 setInIframe(window !== window.top);

19 setIsAuthed(checkInspectorAuth());

20 setIsTranslationInspectorPath(window.location.pathname.includes('/translation-inspector'));

21 if (pageInspector) {

22 const slug = typeof pageInspector === 'string' ? pageInspector : 'design-inspector';

23 setIsPageInspectorPath(window.location.pathname.includes(`/${slug}`));

24 }

25 }, [pageInspector]);

26 useEffect(() => {

27 const names = variableCssSource?.trim()

28 ? extractCssCustomPropertyNamesFromText(variableCssSource)

29 : null;

30 useInspectorStore.getState().setFileVariableNames(names);

dist/components/TranslationInspectorPage/index.jsView file

Lines 1-27javascript

1'use client';

2import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';

3import { createPortal } from 'react-dom';

4import { tlDbRead, tlDbWrite } from '../../utils/translation-indexed-db';

5import './style.css';

6const TI_AUTH_KEY

dist/components/TranslationInspectorPage/index.d.tsView file

Lines 1-19typescript

1import React from 'react';

2import './style.css';

3export type TranslationLangConfig = {

4 code: string;

5 /** Project-relative path, e.g. `src/translations/en.json` */

6 relativePath

dist/InspectorProvider.d.tsView file

Lines 1-33typescript

1import React from 'react';

2import type { InspectorMediaTierSpec, InspectorRewriteGlobalVariableFn, InspectorVariableMediaBreakpoint } from './types';

3import './design-inspector-ui.css';

4export interface InspectorProviderProps {

5 variableCssSource?: string;