registry / keystone-design-bootstrap / 1.0.102

keystone-design-bootstrap@1.0.102

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Keystone Design Bootstrap - Sections, Elements, and Theme System for customer websites

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Runtime network behavior is user-invoked design-system functionality for maps, forms, chat, auth, and analytics/logging.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing/mounting exported React or Next components; no install-time trigger.

Impact

Expected application telemetry and Keystone/customer API interaction; no source evidence of theft, persistence, or remote code execution.

Mechanism

client/server design-system components make configured API and analytics requests

Rationale

Static source inspection shows a normal React/Next design-system package with no lifecycle hooks and only package-aligned runtime network behavior. The scanner's secret/network findings are explained by a browser Google Maps component and optional PostHog/API integrations, not malware.

Evidence

package.jsonsrc/index.tssrc/design_system/elements/map/GoogleMap.tsxsrc/tracking/PostHogProvider.tsxsrc/tracking/logging.tssrc/tracking/captureEvent.tssrc/lib/server-api.tssrc/next/routes/chat.tssrc/next/routes/form.tssrc/next/routes/consumer-auth.ts

Network endpoints4

maps.googleapis.com/maps/api/jsmaps.google.com/?q=us.i.posthog.comlocalhost:3000/api/v1

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

src/design_system/elements/map/GoogleMap.tsx embeds a Google Maps browser API key and loads maps.googleapis.com at component mount.
src/tracking/PostHogProvider.tsx initializes PostHog only when a consumer supplies apiKey and provider is mounted.
src/tracking/logging.ts can ship warn/error logs to PostHog OTLP when initialized with that consumer-supplied key.

Evidence against

package.json has no preinstall/install/postinstall scripts or bin entries.
Main/exported files are React/Next design-system components and helpers, not install-time code.
No child_process, shell execution, eval/Function, native binary loading, or package file writes found by source search.
Network calls are package-aligned: app API routes, Google Maps, PostHog analytics/logging, and consumer-configured API_URL/API_KEY.
The hardcoded Google Maps key is a public client-side key pattern, not credential harvesting or exfiltration logic.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 230 file(s), 1.10 MB of source, external domains: connect.facebook.net, images.unsplash.com, maps.google.com, maps.googleapis.com, us.i.posthog.com, www.facebook.com, www.googletagmanager.com, www.keystone.app, www.untitledui.com, www.w3.org, www.youtube.com

Source & flagged code

2 flagged

src/design_system/elements/map/GoogleMap.tsxView file

Lines 51-91tsx

51 markers?: GoogleMarker[];

52}

54interface GoogleMarkerOptions {

55 map: GoogleMapInstance;

56 position: GoogleLatLng;

57 title: string;

58}

60interface GoogleMarker {

61 map: GoogleMapInstance | null;

62}

64declare global {

65 interface Window {

66 google?: GoogleMaps;

67 [key: string]: unknown; // Allow dynamic callback properties

68 }

69}

71const GOOGLE_MAPS_API_KEY = 'AIzaSyAb4-zSsPFx-QGi4cAiCGaRrzsAJC6e348';

High

High Secret

Package contains a high-severity secret pattern.

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L71

High

Secret Pattern

Google API key in src/design_system/elements/map/GoogleMap.tsx

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L71

73export default function GoogleMap({ address, locationName, className = '' }: GoogleMapProps) {

74 const mapRef = useRef<HTMLDivElement>(null);

75 const [mapError, setMapError] = useState<string | null>(null);

76 const [isLoaded, setIsLoaded] = useState(false);

77 const geocoderRef = useRef<GoogleGeocoder | null>(null);

78 const mapInstanceRef = useRef<GoogleMapInstance | null>(null);

79 const isInitializingRef = useRef(false);

80 const callbackNameRef = useRef<string | null>(null);

82 // Initialize map once Google Maps API is loaded

83 // Use ref to store callback to avoid "accessed before declaration" error

84 const initMapRef = useRef<(() => Promise<void>) | null>(null);

86 const initMap = useCallback(async () => {

87 // Prevent multiple simultaneous initializations

88 if (isInitializingRef.current) return;

90 // Ensure DOM element exists and Google Maps is fully loaded

91 if (!mapRef.current || !window.google || !window.google.maps) {

Source & flagged code

2 flagged · loading source

src/design_system/elements/map/GoogleMap.tsxView file

71patternName = google_api_key severity = high line = 71 matchedText = const GO...48';

High

High Secret

Package contains a high-severity secret pattern.

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L71

71patternName = google_api_key severity = high line = 71 matchedText = const GO...48';

High

Secret Pattern

Google API key in src/design_system/elements/map/GoogleMap.tsx

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L71

Findings

2 High2 Medium4 Low

HighHigh Secretsrc/design_system/elements/map/GoogleMap.tsx

HighSecret Patternsrc/design_system/elements/map/GoogleMap.tsx

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

src/design_system/elements/map/GoogleMap.tsxView file

Lines 51-91tsx

51 markers?: GoogleMarker[];

52}

54interface GoogleMarkerOptions {

55 map: GoogleMapInstance;

56 position: GoogleLatLng;

57 title: string;

58}

60interface GoogleMarker {

61 map: GoogleMapInstance | null;

62}

64declare global {

65 interface Window {

66 google?: GoogleMaps;

67 [key: string]: unknown; // Allow dynamic callback properties

68 }

69}

71const GOOGLE_MAPS_API_KEY = 'AIzaSyAb4-zSsPFx-QGi4cAiCGaRrzsAJC6e348';

High

High Secret

Package contains a high-severity secret pattern.

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L71

High

Secret Pattern

Google API key in src/design_system/elements/map/GoogleMap.tsx

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L71

73export default function GoogleMap({ address, locationName, className = '' }: GoogleMapProps) {

74 const mapRef = useRef<HTMLDivElement>(null);

75 const [mapError, setMapError] = useState<string | null>(null);

76 const [isLoaded, setIsLoaded] = useState(false);

77 const geocoderRef = useRef<GoogleGeocoder | null>(null);

78 const mapInstanceRef = useRef<GoogleMapInstance | null>(null);

79 const isInitializingRef = useRef(false);

80 const callbackNameRef = useRef<string | null>(null);

82 // Initialize map once Google Maps API is loaded

83 // Use ref to store callback to avoid "accessed before declaration" error

84 const initMapRef = useRef<(() => Promise<void>) | null>(null);

86 const initMap = useCallback(async () => {

87 // Prevent multiple simultaneous initializations

88 if (isInitializingRef.current) return;

90 // Ensure DOM element exists and Google Maps is fully loaded

91 if (!mapRef.current || !window.google || !window.google.maps) {