registry / dirk-cfx-react / 1.1.95

dirk-cfx-react@1.1.95

A modular **React + TypeScript** component library for **FiveM** and **RedM** UI development. Includes pre-styled Mantine components, hooks, and utilities optimized for CFX frameworks.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 28 file(s), 3.11 MB of source, external domains: docs.fivem.net, fmapi.net, i.ytimg.com, raw.githubusercontent.com, s.rsg.sc

Source & flagged code

4 flagged

dist/chunk-YA2PXBP6.cjsView file

Lines 824-864javascript

824 nextLevelXP,

825 progressToLevel: Math.min(100, Math.max(0, progressToLevel)),

826 xpToNextLevel

827 };

828 }, [xp, levelMap, settings]);

829 };

830 const skill = {

831 get settings() {

832 return useStore.getState().settings;

833 },

834 setSettings: (updater) => {

835 useStore.getState().setSettings(updater);

836 },

837 useSettings: () => useStore((state) => state.settings)

838 };

839 return {

840 skill,

841 useSkill

842 };

843}

844var dummyURL = "https://fmapi.net/api/v2/presigned-url/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJON0UxM0tzejFRM0NuSzRHWFBPbmUiLCJ0ZWFtSWQiOiJlMDQ1YnpwZzg5TGpoaUFTaURIdVoiLCJmaWxlVHlwZSI6ImltYWdlIiwidG9rZW5JZCI6ImpwczJ4Z0M1eFZqcnRoeWZTZnFsYSIsInNldHRpbmdzIjp7IlRlYW1JRCI6ImUwNDVienBnODlMamhpQVNpREh1WiIsIkltYWdlTm90aWZpY2F0aW9uVHlwZSI6IiIsIkRpc2NvcmRXZWJob29rIjoiIiwiRGlzY29yZEltYWdlQ2hhbm5lbCI6IiIsIlZpZGVvTm90aWZpY2F0aW9uVHlwZSI6IiIsIkRpc2NvcmRWaWRlb1dlYmhvb2siOiIiLCJEaXNjb3JkVmlkZW9DaGFubmVsIjoiIiwiQXVkaW9Ob3RpZmljYXRpb25UeXBlIjoiIiwiRGlzY29yZEF1ZGlvV2ViaG9vayI6IiIsIkRpc2NvcmRBdWRpb0No ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-YA2PXBP6.cjsView on unpkg · L844

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-YA2PXBP6.cjs

dist/chunk-YA2PXBP6.cjsView on unpkg · L844

845async function updatePresignedURL() {

846 return await fetchNui("GET_PRESIGNED_URL", void 0, dummyURL);

847}

848async function uploadImage(props) {

849 const uploadURL = await updatePresignedURL();

850 const response = await fetch(props.fileURL);

851 const blob = await response.blob();

852 const file = new File([blob], "upload.png", { type: blob.type });

853 const formData = new FormData();

854 formData.append("file", file);

855 formData.append(

856 "metadata",

857 JSON.stringify({

858 name: props.name || file.name,

859 description: props.description || "Uploaded via DirkScripts"

860 })

861 );

862 const uploadRes = await axios__default.default.post(uploadURL, formData, {

863 headers: { "Content-Type": "multipart/form-data" }

864 });

Long lines were clipped for display.

dist/hover_sound-NBUA222C.mp3View file

•path = dist/hover_sound-NBUA222C.mp3 kind = high_entropy_blob sizeBytes = 9600 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/hover_sound-NBUA222C.mp3View on unpkg

dist/chunk-MYNNCLMA.jsView file

Lines 818-858javascript

818 nextLevelXP,

819 progressToLevel: Math.min(100, Math.max(0, progressToLevel)),

820 xpToNextLevel

821 };

822 }, [xp, levelMap, settings]);

823 };

824 const skill = {

825

Source & flagged code

4 flagged · loading source

dist/chunk-YA2PXBP6.cjsView file

844patternName = supabase_service_key severity = critical line = 844 matchedText = var dumm...WA";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-YA2PXBP6.cjsView on unpkg · L844

844patternName = supabase_service_key severity = critical line = 844 matchedText = var dumm...WA";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-YA2PXBP6.cjs

dist/chunk-YA2PXBP6.cjsView on unpkg · L844

dist/hover_sound-NBUA222C.mp3View file

•path = dist/hover_sound-NBUA222C.mp3 kind = high_entropy_blob sizeBytes = 9600 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/hover_sound-NBUA222C.mp3View on unpkg

dist/chunk-MYNNCLMA.jsView file

838patternName = supabase_service_key severity = critical line = 838 matchedText = var dumm...WA";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-MYNNCLMA.js

dist/chunk-MYNNCLMA.jsView on unpkg · L838

Findings

3 Critical1 High2 Medium5 Low

CriticalCritical Secretdist/chunk-YA2PXBP6.cjs

CriticalSecret Patterndist/chunk-YA2PXBP6.cjs

CriticalSecret Patterndist/chunk-MYNNCLMA.js

HighShips High Entropy Blobdist/hover_sound-NBUA222C.mp3

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/chunk-YA2PXBP6.cjsView file

Lines 824-864javascript

824 nextLevelXP,

825 progressToLevel: Math.min(100, Math.max(0, progressToLevel)),

826 xpToNextLevel

827 };

828 }, [xp, levelMap, settings]);

829 };

830 const skill = {

831 get settings() {

832 return useStore.getState().settings;

833 },

834 setSettings: (updater) => {

835 useStore.getState().setSettings(updater);

836 },

837 useSettings: () => useStore((state) => state.settings)

838 };

839 return {

840 skill,

841 useSkill

842 };

843}

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-YA2PXBP6.cjsView on unpkg · L844

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-YA2PXBP6.cjs

dist/chunk-YA2PXBP6.cjsView on unpkg · L844

845async function updatePresignedURL() {

846 return await fetchNui("GET_PRESIGNED_URL", void 0, dummyURL);

847}

848async function uploadImage(props) {

849 const uploadURL = await updatePresignedURL();

850 const response = await fetch(props.fileURL);

851 const blob = await response.blob();

852 const file = new File([blob], "upload.png", { type: blob.type });

853 const formData = new FormData();

854 formData.append("file", file);

855 formData.append(

856 "metadata",

857 JSON.stringify({

858 name: props.name || file.name,

859 description: props.description || "Uploaded via DirkScripts"

860 })

861 );

862 const uploadRes = await axios__default.default.post(uploadURL, formData, {

863 headers: { "Content-Type": "multipart/form-data" }

864 });

Long lines were clipped for display.

dist/hover_sound-NBUA222C.mp3View file

•path = dist/hover_sound-NBUA222C.mp3 kind = high_entropy_blob sizeBytes = 9600 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/hover_sound-NBUA222C.mp3View on unpkg

dist/chunk-MYNNCLMA.jsView file

Lines 818-858javascript

818 nextLevelXP,

819 progressToLevel: Math.min(100, Math.max(0, progressToLevel)),

820 xpToNextLevel

821 };

822 }, [xp, levelMap, settings]);

823 };

824 const skill = {

825