registry / keystone-design-bootstrap / 1.0.100

keystone-design-bootstrap@1.0.100

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Keystone Design Bootstrap - Sections, Elements, and Theme System for customer websites

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Runtime network behavior is analytics/customer-site API functionality that requires consumers to mount providers or route handlers and supply configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

consumer imports and uses React components, tracking providers, or Next route handlers

Impact

expected pageview/event logging and customer API form/chat/auth requests when configured

Mechanism

package-aligned analytics and API proxy helpers

Rationale

Static inspection shows a design-system package with optional analytics and server API helpers, no lifecycle execution, and no credential harvesting or exfiltration beyond documented configured endpoints. The suspicious scanner hits are explained by legitimate telemetry/API code and secret-like parameter names rather than embedded secrets or attack behavior.

Evidence

package.jsonsrc/index.tssrc/tracking/logging.tssrc/tracking/PostHogProvider.tsxsrc/tracking/MetaPixel.tsxsrc/tracking/GoogleTagManager.tsxsrc/lib/server-api.tssrc/next/routes/chat.tssrc/next/routes/form.tssrc/next/routes/consumer-auth.ts

Network endpoints6

us.i.posthog.comconnect.facebook.net/en_US/fbevents.jswww.facebook.com/trwww.googletagmanager.com/gtm.jswww.googletagmanager.com/ns.htmllocalhost:3000/api/v1

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall hooks and no bin entrypoints; scripts are build/dev/typecheck/test/lint only.
Main/exported sources are React/Next design-system, route, API, and analytics helpers under src/.
Network use is package-aligned: PostHog, Meta Pixel, GTM, and configured Keystone API proxy calls.
process.env access is limited to API_URL/API_KEY, NODE_ENV, and public logging disable flags for server/client configuration.
Dangerous primitives search found no child_process, fs writes, eval/new Function, shell execution, persistence, or AI-agent control-surface writes in src/dist excluding maps.
Scanner secret signal maps to PostHog API key/token plumbing and env/API config names, not embedded credential literals.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 248 file(s), 3.38 MB of source, external domains: connect.facebook.net, images.unsplash.com, maps.google.com, maps.googleapis.com, motion.dev, us.i.posthog.com, www.facebook.com, www.googletagmanager.com, www.keystone.app, www.untitledui.com, www.w3.org, www.youtube.com

Source & flagged code

6 flagged

dist/design_system/sections/index.jsView file

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2518

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2518

dist/design_system/components/DynamicFormFields.jsView file

Lines 2487-2527javascript

2487var PaginationPageMinimalCenter = (_a) => {

2488 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"]);

2489 const isDesktop = useBreakpoint("md");

2490 return /* @__PURE__ */ React.createElement(

2491 Pagination.Root,

2492 __spreadProps(__spreadValues({}, props), {

2493 page,

2494 total,

2495 className: cx("flex w-full items-center justify-between gap-3 border-t border-secondary pt-4 md:pt-5", className)

2496 }),

2497 /* @__PURE__ */ React.createElement("div", { className: "flex flex-1 justify-start" }, /* @__PURE__ */ React.createElement(Pagination.PrevTrigger, { asChild: true }, /* @__PURE__ */ React.createElement(Button, { iconLeading: ArrowLeft, color: "secondary", size: "sm" }, isDesktop ? "Previous" : void 0))),

2498 /* @__PURE__ */ React.createElement(Pagination.Context, null, ({ pages, currentPage, total: total2 }) => /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("div", { className: "hidden justify-center gap-0.5 md:flex" }, pages.map(

2499 (page2, index) => page2.type === "page" ? /* @__PURE__ */ React.createElement(PaginationItem2, __spreadValues({ key: index, rounded }, page2)) : /* @__PURE__ */ React.createElement(Pagination.Ellipsis, { key: index, className: "flex size-10 shrink-0 items-center justify-center text-tertiary" }, "\u2026")

2500 )), /* @__PURE__ */ React.createElement("div", { className: "flex justify-center text-sm whitespace-pre text-fg-secondary md:hidden" }, "Page ", /* @__PURE__ */ React.createElement("span", { className: "font-medium" }, currentPage), " of ", /* @__PURE__ */ React.createElement("span", { className: "font-medium" }, total2)))),

2501 /* @__PURE__ */ React.createElement("div", { className: "flex flex-1 justify-end" }, /* @__PURE__ */ React.createElement(Pagination.NextTrigger, { asChild: true }, /* @__PURE__ */ React.createElement(Button, { iconTrailing: ArrowRight2, color: "secondary", size: "sm" }, isDesktop ? "Next" : void 0)))

2502 );

2503};

2504

2505// src/design_system/elements/map/GoogleMap.tsx

2506import { useEffect as useEffect3, useRef as useRef2, useState as useState4, useCallback as useCallback2 } from "react";

2507var GOOGLE_MAPS_API_KEY = "AIzaSyAb4-zSsPFx-QGi4cAiCGaRrzsAJC6e348";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2507

2508function GoogleMap({ address, locationName, className = "" }) {

2509 const mapRef = useRef2(null);

2510 const [mapError, setMapError] = useState4(null);

2511 const [isLoaded, setIsLoaded] = useState4(false);

2512 const geocoderRef = useRef2(null);

2513 const mapInstanceRef = useRef2(null);

2514 const isInitializingRef = useRef2(false);

2515 const callbackNameRef = useRef2(null);

2516 const initMapRef = useRef2(null);

2517 const initMap = useCallback2(async () => {

2518 if (isInitializingRef.current) return;

2519 if (!mapRef.current || !window.google || !window.google.maps) {

2520 return;

2521 }

2522 if (!window.google.maps.Geocoder) {

2523 warn("google-map", "GEOCODER_NOT_READY_RETRYING", {

2524 address

2525 });

2526 setTimeout(() => {

2527 var _a, _b;

dist/design_system/elements/index.jsView file

Lines 2482-2522javascript

2482var PaginationPageMinimalCenter = (_a) => {

2483 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"

dist/index.jsView file

2544patternName = google_api_key severity = high line = 2544 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2544

src/design_system/elements/map/GoogleMap.tsxView file

Lines 51-91tsx

51 markers?: GoogleMarker[];

52}

54interface GoogleMarkerOptions {

55 map: GoogleMapInstance;

56 position: GoogleLatLng;

57 title: string;

Source & flagged code

6 flagged · loading source

dist/design_system/sections/index.jsView file

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2518

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2518

dist/design_system/components/DynamicFormFields.jsView file

2507patternName = google_api_key severity = high line = 2507 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2507

dist/design_system/elements/index.jsView file

2502patternName = google_api_key severity = high line = 2502 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/elements/index.js

dist/design_system/elements/index.jsView on unpkg · L2502

dist/index.jsView file

2544patternName = google_api_key severity = high line = 2544 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2544

src/design_system/elements/map/GoogleMap.tsxView file

71patternName = google_api_key severity = high line = 71 matchedText = const GO...48';

High

Secret Pattern

Google API key in src/design_system/elements/map/GoogleMap.tsx

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L71

Findings

6 High2 Medium4 Low

HighHigh Secretdist/design_system/sections/index.js

HighSecret Patterndist/design_system/sections/index.js

HighSecret Patterndist/design_system/components/DynamicFormFields.js

HighSecret Patterndist/design_system/elements/index.js

HighSecret Patterndist/index.js

HighSecret Patternsrc/design_system/elements/map/GoogleMap.tsx

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/design_system/sections/index.jsView file

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2518

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2518

dist/design_system/components/DynamicFormFields.jsView file

Lines 2487-2527javascript

2487var PaginationPageMinimalCenter = (_a) => {

2488 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"]);

2489 const isDesktop = useBreakpoint("md");

2490 return /* @__PURE__ */ React.createElement(

2491 Pagination.Root,

2492 __spreadProps(__spreadValues({}, props), {

2493 page,

2494 total,

2495 className: cx("flex w-full items-center justify-between gap-3 border-t border-secondary pt-4 md:pt-5", className)

2496 }),

2502 );

2503};

2504

2505// src/design_system/elements/map/GoogleMap.tsx

2506import { useEffect as useEffect3, useRef as useRef2, useState as useState4, useCallback as useCallback2 } from "react";

2507var GOOGLE_MAPS_API_KEY = "AIzaSyAb4-zSsPFx-QGi4cAiCGaRrzsAJC6e348";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2507

2508function GoogleMap({ address, locationName, className = "" }) {

2509 const mapRef = useRef2(null);

2510 const [mapError, setMapError] = useState4(null);

2511 const [isLoaded, setIsLoaded] = useState4(false);

2512 const geocoderRef = useRef2(null);

2513 const mapInstanceRef = useRef2(null);

2514 const isInitializingRef = useRef2(false);

2515 const callbackNameRef = useRef2(null);

2516 const initMapRef = useRef2(null);

2517 const initMap = useCallback2(async () => {

2518 if (isInitializingRef.current) return;

2519 if (!mapRef.current || !window.google || !window.google.maps) {

2520 return;

2521 }

2522 if (!window.google.maps.Geocoder) {

2523 warn("google-map", "GEOCODER_NOT_READY_RETRYING", {

2524 address

2525 });

2526 setTimeout(() => {

2527 var _a, _b;

dist/design_system/elements/index.jsView file

Lines 2482-2522javascript

2482var PaginationPageMinimalCenter = (_a) => {

2483 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"

dist/index.jsView file

2544patternName = google_api_key severity = high line = 2544 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2544

src/design_system/elements/map/GoogleMap.tsxView file

Lines 51-91tsx

51 markers?: GoogleMarker[];

52}

54interface GoogleMarkerOptions {

55 map: GoogleMapInstance;

56 position: GoogleLatLng;

57 title: string;