registry / cozy-ui / 140.1.2

cozy-ui@140.1.2

Cozy apps UI SDK

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 851 file(s), 1.35 MB of source, external domains: apps.apple.com, collect.cozy.mock, cozy.io, docs.cozy.io, drive.cozy.mock, play.google.com

Source & flagged code

11 flagged

package.jsonView file

Lines 2-76json

2 "name": "cozy-ui",

3 "version": "140.1.2",

4 "description": "Cozy apps UI SDK",

5 "engines": {

6 "node": "24.x"

7 },

8 "main": "./index.js",

9 "bin": {

10 "rsg-screenshots": "./scripts/screenshots.js"

11 },

12 "repository": {

13 "type": "git",

14 "url": "https://github.com/cozy/cozy-ui.git"

15 },

16 "author": "Cozy Cloud <contact@cozycloud.cc> (http://cozycloud.cc)",

17 "license": "MIT",

18 "bugs": {

19 "url": "https://github.com/cozy/cozy-ui/issues"

20 },

21 "homepage": "https://github.com/cozy/cozy-ui",

22 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L22

23 "argos:upload": "argos upload",

24 "stylus-build": "stylus -c --include stylus --use ./node_modules/autoprefixer-stylus",

25 "build:css:all": "yarn build:css && yarn build:css:utils && yarn run removeEmptyCss",

26 "build:css": "env CSSMODULES=false yarn run stylus-build -o dist/cozy-ui.min.css stylus/cozy-ui/build.styl",

27 "build:css:utils": "env CSSMODULES=false yarn run stylus-build -o dist/cozy-ui.utils.min.css stylus/cozy-ui/utils.styl",

28 "build:css:kss": "env CSSMODULES=false yarn run stylus-build -o build/styleguide/app.css stylus/cozy-ui/build.styl",

29 "build:doc": "npm-run-all 'build:doc:*'",

30 "build:doc:skill": "node scripts/generate-skill.js",

31 "build:doc:config": "copyfiles -u 1 docs/*.md docs/_config.yml build",

32 "build:doc:kss": "NODE_OPTIONS=--openssl-legacy-provider kss --destination build/styleguide --title 'Cozy-UI Styleguide' --source stylus --builder node_modules/michelangelo/kss_styleguide/custom-template --homepage stylus/styleguide.md --css app.css",

33 "build:doc:react": "NODE_OPTIONS=--openssl-legacy-provider styleguidist build --config docs/styleguide.config.js",

34 "build:types": "tsc -p tsconfig-build.json",

35 "build:all": "yarn makePalette && yarn build && yarn build:css:all && yarn build:doc",

36 "build:js": "env BABEL_ENV=transpilation babel --extensions .ts,.tsx,.js,.jsx,.md,.styl,.json,.snap react/ --out-dir transpiled/react --copy-files --no-copy-ignored --verbose",

37 "build": "yarn build:types && yarn build:js",

38 "clean:doc:kss": "rm -rf build/styleguide",

39 "deploy:doc": "git-directory-deploy --directory build/ --branch gh-pages",

40 "makeSvgr": "scripts/generate-svgr-icon.sh",

41 "lint": "npm-run-all 'lint:*'",

42 "lint:js": "eslint 'react/**/*.jsx' 'react/**/*.js' 'react/**/*.ts' 'react/**/*.tsx' 'docs/styleguide.config.js'",

43 "lint:stylus": "stylint stylus --config .stylintrc",

44 "lint:md": "remark . -o -S",

45 "makePalette": "scripts/make-palette.sh",

46 "prebuild:css": "mkdir -p dist/ && stylus -C node_modules/normalize.css/normalize.css node_modules/normalize.css/normalize.styl",

47 "prebuild:css:utils": "mkdir -p dist/",

48 "prebuild:css:kss": "mkdir -p build/styleguide && stylus -C node_modules/normalize.css/normalize.css node_modules/normalize.css/normalize.styl",

49 "prebuild:doc:kss": "run-s clean:doc:kss build:css:kss",

50 "semantic-release": "semantic-release",

51 "sprite": "scripts/make-icon-sprite.sh",

52 "screenshots": "node scripts/screenshots.js --screenshot-dir ./screenshots --styleguide-url file://$(pwd)/build/react --kss-dir ./build/styleguide",

53 "test": "jest",

54 "screenshots:server": "nodemon ./scripts/pixelmatch-server/server.js -e js,hbs",

55 "postbuild": "postcss transpiled/react/stylesheet.css --replace",

56 "postinstall": "/bin/bash -c 'if [ -d node_modules/@fastify/deepmerge ]; then patch-package; fi'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "travis-deploy-once": "travis-deploy-once",

58 "start:css:utils": "yarn build:css:utils --watch",

59 "start:css": "yarn build:css --watch",

60 "start:doc": "NODE_OPTIONS=--openssl-legacy-provider env BUILD_ENV=watch-styleguidist styleguidist server --config docs/styleguide.config.js",

61 "start:doc:kss": "nodemon --ext styl,md --watch stylus --exec 'yarn build:doc:kss && http-server build/styleguide -p 4242'",

62 "start": "yarn build --watch",

63 "removeEmptyCss": "node scripts/removeEmptyCss.js",

64 "optimizeIcons": "svgo -r --folder assets/icons"

65 },

66 "types": "dist/index.d.ts",

67 "sideEffects": [

68 "*.css",

69 "intersection-observer"

70 ],

71 "devDependencies": {

72 "@argos-ci/cli": "1.0.4",

73 "@babel/cli": "7.17.6",

74 "@babel/core": "7.17.8",

75 "@babel/eslint-parser": "7.19.1",

76 "@babel/helper-builder-react-jsx": "7.16.7",

transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.jsView file

Lines 4-167javascript

4 allow: "Allow",

5 "allow-location-dialog": {

6 title: "Allow access to your location",

7 description: "Your Twake needs to always be authorised to access your phone's location in order to memorise and help you analyse your movements, even when the app is not in use.\n\nIt will NEVER be passed on to anyone without your request.\n\nYou can deactivate this feature from the Coach CO2 app settings."

stylus/index.jsView file

Lines 1-31javascript

1/**

2 * Cozy-Ui

3 *

4 * A [Cozy](http://cozy.io/) apps Ui SDK

5 *

6 * https://github.com/m4dz/cozy-ui

7 * AGPL-3.0 Licensed

8 */

10'use strict'

12var path =

scripts/generate-svgr-icon.shView file

•path = scripts/generate-svgr-icon.sh kind = build_helper sizeBytes = 638 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-svgr-icon.shView on unpkg

assets/fonts/Lato-Bold.woffView file

•path = assets/fonts/Lato-Bold.woff kind = high_entropy_blob sizeBytes = 309728 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/fonts/Lato-Bold.woffView on unpkg

react/Labs/PasswordInput/helpers.spec.jsView file

21patternName = generic_password severity = medium line = 21 matchedText = const pa...rd!'

Medium

Secret Pattern

Hardcoded password in react/Labs/PasswordInput/helpers.spec.js

react/Labs/PasswordInput/helpers.spec.jsView on unpkg · L21

Source & flagged code

11 flagged · loading source

package.jsonView file

•dependencies changed=mui-bottom-sheet; devDependencies changed=michelangelo

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = /bin/bash -c 'if [ -d node_modules/@fastify/deepmerge ]; then patch-package; fi'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = /bin/bash -c 'if [ -d node_modules/@fastify/deepmerge ]; then patch-package; fi'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.jsView file

Findings

1 Critical2 High10 Medium5 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobassets/fonts/Lato-Bold.woff

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterntranspiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.js

MediumDynamic Requirestylus/index.js

MediumEnvironment Vars

MediumShips Build Helperscripts/generate-svgr-icon.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntranspiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.js