registry / @widget-js/react / 26.7.21

@widget-js/react@26.7.21

React hooks and components for building widgets in the widget-js ecosystem. This library provides a comprehensive set of tools to interact with the widget system, manage window states, and handle system events.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 2.04 MB of source, external domains: base-ui.com, cdn.jsdelivr.net, developer.mozilla.org, drafts.csswg.org, eips.ethereum.org, example.supabase.co, fb.me, github.com, mozilla.github.io, radix-ui.com, react.dev, styled-components.com, supabase.github.io, supabase.widgetjs.cn, w3c.github.io, www.electronjs.org, www.postgresql.org, www.rfc-editor.org, www.w3.org, xyzcompany.supabase.co

Source & flagged code

5 flagged

dist/index.es.jsView file

39135patternName = supabase_service_key severity = critical line = 39135 matchedText = let Fl =...Bs";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.es.jsView on unpkg · L39135

39135patternName = supabase_service_key severity = critical line = 39135 matchedText = let Fl =...Bs";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.es.js

dist/index.es.jsView on unpkg · L39135

20950toPlainObject: s, L20951: fork(a) { L20952: const u = Gh({}, e);

High

Child Process

Package source references child process execution.

dist/index.es.jsView on unpkg · L20950

dist/index.umd.jsView file

297patternName = supabase_service_key severity = critical line = 297 matchedText = `);const...}));

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.umd.js

dist/index.umd.jsView on unpkg · L297

65linear-gradient(45deg, #d4d4d8 25%, transparent 25%, transparent 75%, #d4d4d8 75%, #d4d4d8 100%) L66: `,backgroundPosition:"0 0, 6px 6px",backgroundSize:"12px 12px"}}),_.jsx("div",{className:"absolute inset-0 cursor-pointer",style:{backgroundColor:t}})]}),_.jsx(us,{id:s,className:"... L67: `))},[n,r,e]);const{current:l}=y.useRef(t);y.useEffect(()=>{!o&&Yv(l)!==Yv(t)&&Ml([`A component is changing the default ${n} state of an uncontrolled ${r} after being initialized. ... ... L78: `+t+` L79: --`+new Array((r||t.length)+1).join("-")+"^"})}const XD=9,JD=10,QD=12,ZD=13,e2=32;class t2{constructor(t){this.str=t,this.pos=0}charCodeAt(t){return t<this.str.length?this.str.char... L80: `);return`${t} {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.umd.jsView on unpkg · L65

Source & flagged code

5 flagged · loading source

dist/index.es.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code