registry / keystone-design-bootstrap / 1.0.96

keystone-design-bootstrap@1.0.96

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Keystone Design Bootstrap - Sections, Elements, and Theme System for customer websites

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Network behavior is user/runtime-invoked website functionality for forms, chat, maps, and analytics.

Static reason

One or more suspicious static signals were detected.

Trigger

Host app imports components/routes and users interact with forms, chat, maps, or configured analytics.

Impact

User-submitted website data may be sent to the host app's Keystone backend and configured analytics providers; no unauthorized exfiltration found.

Mechanism

Package-aligned UI/API proxy and analytics integrations

Rationale

Static source inspection shows a legitimate React/Next design-system package with server route helpers and opt-in analytics/tracking integrations. Suspicious primitives are package-aligned and user-invoked, with no install-time execution, credential harvesting, unauthorized file access, or malicious exfiltration.

Evidence

package.jsonsrc/index.tssrc/lib/server-api.tssrc/lib/actions.tssrc/next/routes/form.tssrc/next/routes/chat.tssrc/next/routes/consumer-auth.tssrc/tracking/MetaPixel.tsxsrc/tracking/PostHogProvider.tsxsrc/tracking/GoogleTagManager.tsxsrc/design_system/elements/map/GoogleMap.tsxsrc/design_system/sections/contact-section-form.tsx

Network endpoints8

/api/form//api/chat/localhost:3000/api/v1connect.facebook.net/en_US/fbevents.jswww.facebook.com/trus.i.posthog.comwww.googletagmanager.com/gtm.jswww.googletagmanager.com/ns.html

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

src/design_system/elements/map/GoogleMap.tsx contains a hardcoded Google Maps browser API key.
Client forms submit user-entered data to local app routes such as /api/form/ and /api/chat/.
Tracking integrations load Meta Pixel, GTM, and PostHog when configured by the host app.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks or bin entrypoint.
src/index.ts only re-exports design system, actions, contexts, and components.
src/lib/server-api.ts and src/next/routes/*.ts proxy to API_URL with API_KEY for documented Keystone backend use.
No child_process, fs writes, eval/vm, native loading, persistence, or destructive behavior found.
No reviewer/prompt manipulation strings found in package source.
Scanner secret hit is a public Google Maps client key, not credential harvesting or exfiltration logic.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 247 file(s), 3.33 MB of source, external domains: connect.facebook.net, images.unsplash.com, maps.google.com, maps.googleapis.com, motion.dev, us.i.posthog.com, www.facebook.com, www.googletagmanager.com, www.keystone.app, www.untitledui.com, www.w3.org, www.youtube.com

Source & flagged code

6 flagged

dist/design_system/sections/index.jsView file

2394patternName = google_api_key severity = high line = 2394 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2394

2394patternName = google_api_key severity = high line = 2394 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2394

dist/design_system/components/DynamicFormFields.jsView file

Lines 2366-2406javascript

2366var PaginationPageMinimalCenter = (_a) => {

2367 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"]);

2368 const isDesktop = useBreakpoint("md");

2369 return /* @__PURE__ */ React.createElement(

2370 Pagination.Root,

2371 __spreadProps(__spreadValues({}, props), {

2372 page,

2373 total,

2374 className: cx("flex w-full items-center justify-between gap-3 border-t border-secondary pt-4 md:pt-5", className)

2375 }),

2376 /* @__PURE__ */ React.createElement("div", { className: "flex flex-1 justify-start" }, /* @__PURE__ */ React.createElement(Pagination.PrevTrigger, { asChild: true }, /* @__PURE__ */ React.createElement(Button, { iconLeading: ArrowLeft, color: "secondary", size: "sm" }, isDesktop ? "Previous" : void 0))),

2377 /* @__PURE__ */ React.createElement(Pagination.Context, null, ({ pages, currentPage, total: total2 }) => /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("div", { className: "hidden justify-center gap-0.5 md:flex" }, pages.map(

2378 (page2, index) => page2.type === "page" ? /* @__PURE__ */ React.createElement(PaginationItem2, __spreadValues({ key: index, rounded }, page2)) : /* @__PURE__ */ React.createElement(Pagination.Ellipsis, { key: index, className: "flex size-10 shrink-0 items-center justify-center text-tertiary" }, "\u2026")

2379 )), /* @__PURE__ */ React.createElement("div", { className: "flex justify-center text-sm whitespace-pre text-fg-secondary md:hidden" }, "Page ", /* @__PURE__ */ React.createElement("span", { className: "font-medium" }, currentPage), " of ", /* @__PURE__ */ React.createElement("span", { className: "font-medium" }, total2)))),

2380 /* @__PURE__ */ React.createElement("div", { className: "flex flex-1 justify-end" }, /* @__PURE__ */ React.createElement(Pagination.NextTrigger, { asChild: true }, /* @__PURE__ */ React.createElement(Button, { iconTrailing: ArrowRight2, color: "secondary", size: "sm" }, isDesktop ? "Next" : void 0)))

2381 );

2382};

2383

2384// src/design_system/elements/map/GoogleMap.tsx

2385import { useEffect as useEffect3, useRef as useRef2, useState as useState4, useCallback as useCallback2 } from "react";

2386var GOOGLE_MAPS_API_KEY = "AIzaSyAb4-zSsPFx-QGi4cAiCGaRrzsAJC6e348";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2386

2387function GoogleMap({ address, locationName, className = "" }) {

2388 const mapRef = useRef2(null);

2389 const [mapError, setMapError] = useState4(null);

2390 const [isLoaded, setIsLoaded] = useState4(false);

2391 const geocoderRef = useRef2(null);

2392 const mapInstanceRef = useRef2(null);

2393 const isInitializingRef = useRef2(false);

2394 const callbackNameRef = useRef2(null);

2395 const initMapRef = useRef2(null);

2396 const initMap = useCallback2(async () => {

2397 if (isInitializingRef.current) return;

2398 if (!mapRef.current || !window.google || !window.google.maps) {

2399 return;

2400 }

2401 if (!window.google.maps.Geocoder) {

2402 console.warn("Google Maps Geocoder not yet available, retrying...");

2403 setTimeout(() => {

2404 var _a, _b;

2405 if (mapRef.current && ((_b = (_a = window.google) == null ? void 0 : _a.maps) == null ? void 0 : _b.Geocoder) && initMapRef.current) {

2406 void initMapRef.current();

dist/design_system/elements/index.jsView file

Lines 2361-2401javascript

2361var PaginationPageMinimalCenter = (_a) => {

2362 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"

dist/index.jsView file

2422patternName = google_api_key severity = high line = 2422 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2422

src/design_system/elements/map/GoogleMap.tsxView file

Lines 50-90tsx

50 markers?: GoogleMarker[];

51}

53interface GoogleMarkerOptions {

54 map: GoogleMapInstance;

55 position: GoogleLatLng;

56 title: string;

Source & flagged code

6 flagged · loading source

dist/design_system/sections/index.jsView file

2394patternName = google_api_key severity = high line = 2394 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2394

2394patternName = google_api_key severity = high line = 2394 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2394

dist/design_system/components/DynamicFormFields.jsView file

2386patternName = google_api_key severity = high line = 2386 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2386

dist/design_system/elements/index.jsView file

2381patternName = google_api_key severity = high line = 2381 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/elements/index.js

dist/design_system/elements/index.jsView on unpkg · L2381

dist/index.jsView file

2422patternName = google_api_key severity = high line = 2422 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2422

src/design_system/elements/map/GoogleMap.tsxView file

70patternName = google_api_key severity = high line = 70 matchedText = const GO...48';

High

Secret Pattern

Google API key in src/design_system/elements/map/GoogleMap.tsx

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L70

Findings

6 High2 Medium4 Low

HighHigh Secretdist/design_system/sections/index.js

HighSecret Patterndist/design_system/sections/index.js

HighSecret Patterndist/design_system/components/DynamicFormFields.js

HighSecret Patterndist/design_system/elements/index.js

HighSecret Patterndist/index.js

HighSecret Patternsrc/design_system/elements/map/GoogleMap.tsx

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/design_system/sections/index.jsView file

2394patternName = google_api_key severity = high line = 2394 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2394

2394patternName = google_api_key severity = high line = 2394 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2394

dist/design_system/components/DynamicFormFields.jsView file

Lines 2366-2406javascript

2366var PaginationPageMinimalCenter = (_a) => {

2367 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"]);

2368 const isDesktop = useBreakpoint("md");

2369 return /* @__PURE__ */ React.createElement(

2370 Pagination.Root,

2371 __spreadProps(__spreadValues({}, props), {

2372 page,

2373 total,

2374 className: cx("flex w-full items-center justify-between gap-3 border-t border-secondary pt-4 md:pt-5", className)

2375 }),

2381 );

2382};

2383

2384// src/design_system/elements/map/GoogleMap.tsx

2385import { useEffect as useEffect3, useRef as useRef2, useState as useState4, useCallback as useCallback2 } from "react";

2386var GOOGLE_MAPS_API_KEY = "AIzaSyAb4-zSsPFx-QGi4cAiCGaRrzsAJC6e348";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2386

2387function GoogleMap({ address, locationName, className = "" }) {

2388 const mapRef = useRef2(null);

2389 const [mapError, setMapError] = useState4(null);

2390 const [isLoaded, setIsLoaded] = useState4(false);

2391 const geocoderRef = useRef2(null);

2392 const mapInstanceRef = useRef2(null);

2393 const isInitializingRef = useRef2(false);

2394 const callbackNameRef = useRef2(null);

2395 const initMapRef = useRef2(null);

2396 const initMap = useCallback2(async () => {

2397 if (isInitializingRef.current) return;

2398 if (!mapRef.current || !window.google || !window.google.maps) {

2399 return;

2400 }

2401 if (!window.google.maps.Geocoder) {

2402 console.warn("Google Maps Geocoder not yet available, retrying...");

2403 setTimeout(() => {

2404 var _a, _b;

2405 if (mapRef.current && ((_b = (_a = window.google) == null ? void 0 : _a.maps) == null ? void 0 : _b.Geocoder) && initMapRef.current) {

2406 void initMapRef.current();

dist/design_system/elements/index.jsView file

Lines 2361-2401javascript

2361var PaginationPageMinimalCenter = (_a) => {

2362 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"

dist/index.jsView file

2422patternName = google_api_key severity = high line = 2422 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2422

src/design_system/elements/map/GoogleMap.tsxView file

Lines 50-90tsx

50 markers?: GoogleMarker[];

51}

53interface GoogleMarkerOptions {

54 map: GoogleMapInstance;

55 position: GoogleLatLng;

56 title: string;