Loading npm security reports…

cozy-ui@140.5.1: Suspicious npm security report (Warn) | LPM Firewall

registry / cozy-ui / 140.5.1

cozy-ui@140.5.1

Cozy apps UI SDK

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 865 file(s), 1.37 MB of source, external domains: apps.apple.com, collect.cozy.mock, cozy.io, docs.cozy.io, drive.cozy.mock, play.google.com

Source & flagged code

11 flagged · loading source

package.jsonView file

•dependencies changed=mui-bottom-sheet; devDependencies changed=michelangelo

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = /bin/bash -c 'if [ -d node_modules/@fastify/deepmerge ]; then patch-package; fi'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = /bin/bash -c 'if [ -d node_modules/@fastify/deepmerge ]; then patch-package; fi'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.jsView file

Findings

1 Critical2 High10 Medium5 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobassets/fonts/Lato-Bold.woff

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterntranspiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.js

MediumDynamic Requirestylus/index.js

MediumEnvironment Vars

MediumShips Build Helperscripts/generate-svgr-icon.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntranspiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.js

MediumSecret Patterntranspiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.js

transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.jsView file

Lines 4-167javascript

4 allow: "Allow",

5 "allow-location-dialog": {

6 title: "Allow access to your location",

7 description: "Your Twake needs to always be authorised to access your phone's location in order to memorise and help you analyse your movements, even when the app is not in use.\n\nIt will NEVER be passed on to anyone without your request.\n\nYou can deactivate this feature from the Coach CO2 app settings."

8 },

9 "install-flagship-app-dialog": {

10 title: "Scan the QR Code",

11 text: "or go directly to the <img src=%{iosIconSrc} /> <a href='%{iosUrl}' class='u-link' target='_blank' rel='noopener'>App Store</a><br>or <img src=%{androidIconSrc} /> <a href='%{androidUrl}' class='u-link' target='_blank' rel='noopener'>Play Store</a> to install the Twake\xA0Workplace app",

12 a11n: "Go to the Twake\xA0Workplace application download page"

13 },

14 "authentification-dialog": {

15 title: "Login",

16 "title-oidc": "Twake Pass",

17 subtitle: "For security, please confirm your identity",

18 label: "Twake password",

19 "label-oidc": "Twake Pass password",

20 abort: "Leave",

21 unlock: "Unlock",

22 "forgotten-password": "I forgot my password",

23 errors: {

24 invalid_password: "Incorrect password, try again.",

Medium

Secret Pattern

Package contains a possible secret pattern.

transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.jsView on unpkg · L24

25 server_error: "Something went wrong with the server. Please, reload the page."

26 }

27 },

28 "shortcut-dialog": {

29 "create-title": "Create a shortcut",

30 "edit-title": "Modify a shortcut",

31 filename: "Shortcut name",

32 url: "URL",

33 cancel: "Cancel",

34 create: "Create",

35 edit: "Save",

36 created: "The shortcut has been created",

37 edited: "The shortcut has been modified",

38 errored: "An error occurred",

39 "needs-info": "A shortcut needs a name and a URL",

40 "url-bad-format": "The entered URL is not in the correct format"

41 }

42};

43var fr = {

44 cancel: "Annuler",

45 allow: "Autoriser",

46 "allow-location-dialog": {

47 title: "Autoriser l'acc\xE8s \xE0 votre position",

48 description: "Votre Twake a besoin d'\xEAtre toujours autoris\xE9 \xE0 acc\xE9der \xE0 la position de votre t\xE9l\xE9phone pour m\xE9moriser, et vous aider \xE0 analyser vos d\xE9placements, m\xEAme lorsque l'app n'est pas utilis\xE9e ou affich\xE9e.\n\nElle ne sera JAMAIS transmise \xE0 qui que ce soit sans votre demande.\n\n

49 },

50 "install-flagship-app-dialog": {

51 title: "Scannez le QR Code",

52 text: "ou rendez vous directement sur <img src=%{iosIconSrc} /> <a href='%{iosUrl}' class='u-link' target='_blank' rel='noopener'>l\u2019App Store</a><br>ou sur le <img src=%{androidIconSrc} /> <a href='%{androidUrl}' class='u-link' target='_blank' rel='noopener'>Play Store</a> pour installer l\u2019app Twake\xA0Workplace",

53 a11n: "Aller sur la page de t\xE9l\xE9chargement de l'application Twake\xA0Workplace"

54 },

55 "authentification-dialog": {

56 title: "Authentification",

57 "title-oidc": "Twake Pass",

58 subtitle: "Par s\xE9curit\xE9, merci de confirmer votre identit\xE9",

59 label: "Mot de passe Twake",

60 "label-oidc": "Mot de passe Twake Pass",

61 abort: "Quitter",

62 unlock: "D\xE9verrouiller",

63 "forgotten-password": "J'ai oubli\xE9 mon mot de passe",

64 errors: {

65 invalid_password: "Mot de passe incorrect, essayer \xE0 nouveau.",

Medium

Secret Pattern

Hardcoded password in transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.js

transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.jsView on unpkg · L65

66 server_error: "Une erreur s'est produite. Merci de recharger la page."

67 }

68 },

69 "shortcut-dialog": {

70 "create-title": "Cr\xE9er un raccourci",

71 "edit-title": "Modifier un raccourci",

72 filename: "Nom du raccourci",

73 url: "URL",

74 cancel: "Annuler",

75 create: "Cr\xE9er",

76 edit: "Sauvegarder",

77 created: "Le raccourci a \xE9t\xE9 cr\xE9\xE9",

78 edited: "Le raccourci a \xE9t\xE9 modifi\xE9",

79 errored: "Une erreur s'est produite",

80 "needs-info": "Un raccourci a besoin d'un nom et d'une URL",

81 "url-bad-format": "L'URL saisie n'est pas dans le bon format"

82 }

83};

84var ru = {

85 cancel: "\u041E\u0442\u043C\u0435\u043D\u0438\u0442\u044C",

86 allow: "\u0420\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044C",

87 "allow-location-dialog": {

88 title: "\u0420\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044C \u0434\u043E\u0441\u0442\u0443\u043F \u043A \u0432\u0430\u0448\u0435\u043C\u0443 \u043C\u0435\u0441\u0442\u043E\u043F\u043E\u043B\u043E\u0436\u0435\u043D\u0438\u044E",

89 description: "\u0412\u0430\u0448\u0435 \u043F\u0440\u0438\u043B\u043E\u0436\u0435\u043D\u0438\u0435 Twake \u0434\u043E\u043B\u0436\u043D\u043E \u0432\u0441\u0435\u0433\u0434\u0430 \u0431\u044B\u0442\u044C \u0430\u0432\u0442\u043E\u0440\u0438\u0437\u043E\u0432\u0430\u043D\u043E \u0434\u043B\u044F \u0434\u043E\u0441\u0442\u0443\u043F\u0430 \u043A \u043C\u0435\u0441\u0442\u043E\u043F\u043E\u043B\u043E\u0436\u0435\u043D\u0438\u044E \u0432\u0430\u0448\u0435\u0433\u043E \u0442\u0435\u043B\u0435\u0444\u043E\u043D\u0430, \u0447\u0442\u043E\u0431\u044B \u0437\u0430\u043F\u043E\u043C\u0438\u043D\u04 ..

90 },

91 "install-flagship-app-dialog": {

92 title: "\u041E\u0442\u0441\u043A\u0430\u043D\u0438\u0440\u0443\u0439\u0442\u0435 QR-\u043A\u043E\u0434",

93 text: "\u0438\u043B\u0438 \u043F\u0435\u0440\u0435\u0439\u0434\u0438\u0442\u0435 \u043D\u0430\u043F\u0440\u044F\u043C\u0443\u044E \u0432 <img src=%{iosIconSrc} /> <a href='%{iosUrl}' class='u-link' target='_blank' rel='noopener'>App Store</a><br>\u0438\u043B\u0438 <img src=%{androidIconSrc} /> <a href='%{androidUrl}' class='u-link' target='_blank' rel='noopener'>Play Store</a> \u0447\u0442\u043E\u0431\u044B \u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u044C \u043F\u0440\u0438\u043B\u043E\u0436\u0435\u043D\u0438\u0435 Twake Workplace",

94 a11n: "\u041F\u0435\u0440\u0435\u0439\u0442\u0438 \u043D\u0430 \u0441\u0442\u0440\u0430\u043D\u0438\u0446\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043A\u0438 \u043F\u0440\u0438\u043B\u043E\u0436\u0435\u043D\u0438\u044F Twake Workplace"

95 },

96 "authentification-dialog": {

97 title: "\u0412\u0445\u043E\u0434",

98 "title-oidc": "Twake Pass",

99 subtitle: "\u0414\u043B\u044F \u0431\u0435\u0437\u043E\u043F\u0430\u0441\u043D\u043E\u0441\u0442\u0438 \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u0435 \u0432\u0430\u0448\u0443 \u043B\u0438\u0447\u043D\u043E\u0441\u0442\u044C",

100 label: "\u041F\u0430\u0440\u043E\u043B\u044C Twake",

101 "label-oidc": "\u041F\u0430\u0440\u043E\u043B\u044C Twake Pass",

102 abort: "\u0412\u044B\u0439\u0442\u0438",

103 unlock: "\u0420\u0430\u0437\u0431\u043B\u043E\u043A\u0438\u0440\u043E\u0432\u0430\u0442\u044C",

104 "forgotten-password": "\u042F \u0437\u0430\u0431\u044B\u043B \u043F\u0430\u0440\u043E\u043B\u044C",

105 errors: {

106 invalid_password: "\u041D\u0435\u0432\u0435\u0440\u043D\u044B\u0439 \u043F\u0430\u0440\u043E\u043B\u044C, \u043F\u043E\u043F\u0440\u043E\u0431\u0443\u0439\u0442\u0435 \u0435\u0449\u0435 \u0440\u0430\u0437.",

Medium

Secret Pattern

Hardcoded password in transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.js

transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.jsView on unpkg · L106

107 server_error: "\u0427\u0442\u043E-\u0442\u043E \u043F\u043E\u0448\u043B\u043E \u043D\u0435 \u0442\u0430\u043A \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u043E\u043C. \u041F\u043E\u0436\u0430\u043B\u0443\u0439\u0441\u0442\u0430, \u043F\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u0435 \u0441\u0442\u0440\u0430\u043D\u0438\u0446\u0443."

108 }

109 },

110 "shortcut-dialog": {

111 "create-title": "\u0421\u043E\u0437\u0434\u0430\u0442\u044C \u044F\u0440\u043B\u044B\u043A",

112 "edit-title": "\u0418\u0437\u043C\u0435\u043D\u0438\u0442\u044C \u044F\u0440\u043B\u044B\u043A",

113 filename: "\u0418\u043C\u044F \u044F\u0440\u043B\u044B\u043A\u0430",

114 url: "URL",

115 cancel: "\u041E\u0442\u043C\u0435\u043D\u0438\u0442\u044C",

116 create: "\u0421\u043E\u0437\u0434\u0430\u0442\u044C",

117 edit: "\u0421\u043E\u0445\u0440\u0430\u043D\u0438\u0442\u044C",

118 created: "\u042F\u0440\u043B\u044B\u043A \u0431\u044B\u043B \u0441\u043E\u0437\u0434\u0430\u043D",

119 edited: "\u042F\u0440\u043B\u044B\u043A \u0431\u044B\u043B \u0438\u0437\u043C\u0435\u043D\u0435\u043D",

120 errored: "\u041F\u0440\u043E\u0438\u0437\u043E\u0448\u043B\u0430 \u043E\u0448\u0438\u0431\u043A\u0430",

121 "needs-info": "\u0414\u043B\u044F \u044F\u0440\u043B\u044B\u043A\u0430 \u043D\u0443\u0436\u043D\u044B \u0438\u043C\u044F \u0438 URL",

122 "url-bad-format": "\u0412\u0432\u0435\u0434\u0451\u043D\u043D\u044B\u0439 URL \u0438\u043C\u0435\u0435\u0442 \u043D\u0435\u0432\u0435\u0440\u043D\u044B\u0439 \u0444\u043E\u0440\u043C\u0430\u0442"

123 }

124};

125var vi = {

126 cancel: "H\u1EE7y",

127 allow: "Cho ph\xE9p",

128 "allow-location-dialog": {

129 title: "Cho ph\xE9p truy c\u1EADp v\xE0o v\u1ECB tr\xED c\u1EE7a b\u1EA1n",

130 description: "Twake c\u1EE7a b\u1EA1n c\u1EA7n ph\u1EA3i lu\xF4n \u0111\u01B0\u1EE3c \u1EE7y quy\u1EC1n \u0111\u1EC3 truy c\u1EADp v\u1ECB tr\xED \u0111i\u1EC7n tho\u1EA1i c\u1EE7a b\u1EA1

131 },

132 "install-flagship-app-dialog": {

133 title: "Qu\xE9t m\xE3 QR",

134 text: "ho\u1EB7c tr\u1EF1c ti\u1EBFp \u0111\u1EBFn <img src=%{iosIconSrc} /> <a href='%{iosUrl}' class='u-link' target='_blank' rel='noopener'>App Store</a><br>ho\u1EB7c <img src=%{androidIconSrc} /> <a href='%{androidUrl}' class='u-link' target='_blank' rel='noopener'>Play Store</a> \u0111\u1EC3 c\xE0i \u0111\u1EB7t \u1EE9ng d\u1EE5ng Twake Workplace",

135 a11n: "\u0110\u1EBFn trang t\u1EA3i xu\u1ED1ng \u1EE9ng d\u1EE5ng Twake Workplace"

136 },

137 "authentification-dialog": {

138 title: "\u0110\u0103ng nh\u1EADp",

139 "title-oidc": "Twake Pass",

140 subtitle: "\u0110\u1EC3 b\u1EA3o m\u1EADt, vui l\xF2ng x\xE1c nh\u1EADn danh t\xEDnh c\u1EE7a b\u1EA1n",

141 label: "M\u1EADt kh\u1EA9u Twake",

142 "label-oidc": "M\u1EADt kh\u1EA9u Twake Pass",

143 abort: "R\u1EDDi kh\u1ECFi",

144 unlock: "M\u1EDF kh\xF3a",

145 "forgotten-password": "T\xF4i qu\xEAn m\u1EADt kh\u1EA9u",

146 errors: {

147 invalid_password: "M\u1EADt kh\u1EA9u kh\xF4ng ch\xEDnh x\xE1c, h\xE3y th\u1EED l\u1EA1i.",

Medium

Secret Pattern

Hardcoded password in transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.js

transpiled/react/CozyDialogs/SpecificDialogs/withSpecificDialogsLocales.jsView on unpkg · L147

148 server_error: "C\xF3 l\u1ED7i x\u1EA3y ra v\u1EDBi m\xE1y ch\u1EE7. Vui l\xF2ng t\u1EA3i l\u1EA1i trang."

149 }

150 },

151 "shortcut-dialog": {

152 "create-title": "T\u1EA1o l\u1ED1i t\u1EAFt",

153 "edit-title": "Ch\u1EC9nh s\u1EEDa l\u1ED1i t\u1EAFt",

154 filename: "T\xEAn l\u1ED1i t\u1EAFt",

155 url: "URL",

156 cancel: "H\u1EE7y",

157 create: "T\u1EA1o",

158 edit: "L\u01B0u",

159 created: "L\u1ED1i t\u1EAFt \u0111\xE3 \u0111\u01B0\u1EE3c t\u1EA1o",

160 edited: "L\u1ED1i t\u1EAFt \u0111\xE3 \u0111\u01B0\u1EE3c ch\u1EC9nh s\u1EEDa",

161 errored: "\u0110\xE3 x\u1EA3y ra l\u1ED7i",

162 "needs-info": "L\u1ED1i t\u1EAFt c\u1EA7n c\xF3 t\xEAn v\xE0 URL",

163 "url-bad-format": "URL \u0111\xE3 nh\u1EADp kh\xF4ng \u0111\xFAng \u0111\u1ECBnh d\u1EA1ng"

164 }

165};

166export var locales = {

167 en: en,

Long lines were clipped for display.