registry / jui-omnibar / 3.4.1

jui-omnibar@3.4.1

Juniper omnibar web components

AI Security Review

scanned 12h ago · by lpm-firewall-ai

Public web-component properties and attributes are rendered with innerHTML without escaping. A host application that supplies attacker-controlled config could enable DOM XSS or unsafe navigation.

Static reason

No blocking static signals were detected.

Trigger

A host renders the components with untrusted product, profile, action, account, or URL configuration.

Impact

Script execution in the embedding site's origin or redirect to an attacker-supplied URL.

Mechanism

Unescaped configuration interpolation into HTML templates

Rationale

The package is not malicious, but its public rendering API has a concrete DOM-injection risk because configuration values are interpolated into innerHTML. Warn pending remediation or confirmation that all callers fully trust and sanitize those values.

Evidence

dist/product-switcher.jsdist/profile-switcher.jspackage.jsonREADME.mddist/omnibar.jsdist/omnibar.d.ts

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

Unescaped public config strings flow into innerHTML templates in dist/product-switcher.js and dist/profile-switcher.js.
Configurable href and image fields are interpolated into HTML attributes.
User-supplied product selection redirects via window.location.href after a countdown.

Evidence against

package.json has only prepublishOnly; no install-time hooks.
No credential, filesystem, process, eval, or network-exfiltration APIs found.
Runtime code is a browser UI web-component bundle.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 73.0 KB of source, external domains: help.junipereducation.org, images.unsplash.com, www.w3.org

Source & flagged code

1 flagged

dist/product-switcher.jsView file

•Published source reference

Medium

Ai Review Evidence

Unescaped public config strings flow into innerHTML templates in dist/product-switcher.js and dist/profile-switcher.js.

dist/product-switcher.jsView on unpkg

Source & flagged code

1 flagged · loading source

dist/product-switcher.jsView file

•Published source reference

Medium

Ai Review Evidence

Unescaped public config strings flow into innerHTML templates in dist/product-switcher.js and dist/profile-switcher.js.

dist/product-switcher.jsView on unpkg

Findings

3 Medium4 Low

MediumAi Review Evidencedist/product-switcher.js

MediumAi Review Evidence

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings