registry / keystone-design-bootstrap / 1.0.99

keystone-design-bootstrap@1.0.99

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Keystone Design Bootstrap - Sections, Elements, and Theme System for customer websites

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network and environment-variable usage is package-aligned analytics, forms, chat, and server API proxy behavior invoked by the consuming app.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer imports components/providers/routes or submits forms/chat actions at runtime.

Impact

Expected site analytics and backend API requests; no install-time/import-time exfiltration or destructive behavior identified.

Mechanism

React/Next UI library with optional analytics and Keystone API proxy helpers.

Rationale

Static inspection shows a legitimate Keystone design-system package with optional analytics and backend proxy helpers, and scanner secret/network hits are explained by API key parameter names and configured service integrations. No lifecycle execution, credential harvesting, shell execution, filesystem mutation, persistence, or reviewer/AI manipulation was found.

Evidence

package.jsonsrc/index.tssrc/tracking/logging.tssrc/tracking/PostHogProvider.tsxsrc/tracking/firePixelEvent.tssrc/lib/server-api.tssrc/lib/actions.tssrc/next/routes/chat.tssrc/next/routes/form.tssrc/next/routes/consumer-auth.ts

Network endpoints7

us.i.posthog.comconnect.facebook.net/en_US/fbevents.jswww.facebook.com/trwww.googletagmanager.com/gtm.jswww.googletagmanager.com/ns.htmllocalhost:3000/api/v1/api/form/

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no lifecycle hooks; scripts are build/dev/typecheck/test/lint only.
Main/exports point to src React/Next design-system, tracking, route-helper modules.
src/tracking/logging.ts ships optional PostHog/OTLP logs only after initializePostHogLogging(apiKey) is called in browser.
src/lib/server-api.ts and src/lib/actions.ts use API_URL/API_KEY for Keystone backend SSR/form requests.
src/tracking/firePixelEvent.ts hashes user email/phone into sessionStorage for Meta Pixel matching; no raw credential harvesting found.
Search found no child_process, fs writes, eval/new Function, persistence, or AI-agent control-surface writes.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 248 file(s), 3.38 MB of source, external domains: connect.facebook.net, images.unsplash.com, maps.google.com, maps.googleapis.com, motion.dev, us.i.posthog.com, www.facebook.com, www.googletagmanager.com, www.keystone.app, www.untitledui.com, www.w3.org, www.youtube.com

Source & flagged code

6 flagged

dist/design_system/sections/index.jsView file

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2518

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2518

dist/design_system/components/DynamicFormFields.jsView file

Lines 2487-2527javascript

2487var PaginationPageMinimalCenter = (_a) => {

2488 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"]);

2489 const isDesktop = useBreakpoint("md");

2490 return /* @__PURE__ */ React.createElement(

2491 Pagination.Root,

2492 __spreadProps(__spreadValues({}, props), {

2493 page,

2494 total,

2495 className: cx("flex w-full items-center justify-between gap-3 border-t border-secondary pt-4 md:pt-5", className)

2496 }),

2497 /* @__PURE__ */ React.createElement("div", { className: "flex flex-1 justify-start" }, /* @__PURE__ */ React.createElement(Pagination.PrevTrigger, { asChild: true }, /* @__PURE__ */ React.createElement(Button, { iconLeading: ArrowLeft, color: "secondary", size: "sm" }, isDesktop ? "Previous" : void 0))),

2498 /* @__PURE__ */ React.createElement(Pagination.Context, null, ({ pages, currentPage, total: total2 }) => /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("div", { className: "hidden justify-center gap-0.5 md:flex" }, pages.map(

2499 (page2, index) => page2.type === "page" ? /* @__PURE__ */ React.createElement(PaginationItem2, __spreadValues({ key: index, rounded }, page2)) : /* @__PURE__ */ React.createElement(Pagination.Ellipsis, { key: index, className: "flex size-10 shrink-0 items-center justify-center text-tertiary" }, "\u2026")

2500 )), /* @__PURE__ */ React.createElement("div", { className: "flex justify-center text-sm whitespace-pre text-fg-secondary md:hidden" }, "Page ", /* @__PURE__ */ React.createElement("span", { className: "font-medium" }, currentPage), " of ", /* @__PURE__ */ React.createElement("span", { className: "font-medium" }, total2)))),

2501 /* @__PURE__ */ React.createElement("div", { className: "flex flex-1 justify-end" }, /* @__PURE__ */ React.createElement(Pagination.NextTrigger, { asChild: true }, /* @__PURE__ */ React.createElement(Button, { iconTrailing: ArrowRight2, color: "secondary", size: "sm" }, isDesktop ? "Next" : void 0)))

2502 );

2503};

2504

2505// src/design_system/elements/map/GoogleMap.tsx

2506import { useEffect as useEffect3, useRef as useRef2, useState as useState4, useCallback as useCallback2 } from "react";

2507var GOOGLE_MAPS_API_KEY = "AIzaSyAb4-zSsPFx-QGi4cAiCGaRrzsAJC6e348";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2507

2508function GoogleMap({ address, locationName, className = "" }) {

2509 const mapRef = useRef2(null);

2510 const [mapError, setMapError] = useState4(null);

2511 const [isLoaded, setIsLoaded] = useState4(false);

2512 const geocoderRef = useRef2(null);

2513 const mapInstanceRef = useRef2(null);

2514 const isInitializingRef = useRef2(false);

2515 const callbackNameRef = useRef2(null);

2516 const initMapRef = useRef2(null);

2517 const initMap = useCallback2(async () => {

2518 if (isInitializingRef.current) return;

2519 if (!mapRef.current || !window.google || !window.google.maps) {

2520 return;

2521 }

2522 if (!window.google.maps.Geocoder) {

2523 warn("google-map", "GEOCODER_NOT_READY_RETRYING", {

2524 address

2525 });

2526 setTimeout(() => {

2527 var _a, _b;

dist/design_system/elements/index.jsView file

Lines 2482-2522javascript

2482var PaginationPageMinimalCenter = (_a) => {

2483 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"

dist/index.jsView file

2544patternName = google_api_key severity = high line = 2544 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2544

src/design_system/elements/map/GoogleMap.tsxView file

Lines 51-91tsx

51 markers?: GoogleMarker[];

52}

54interface GoogleMarkerOptions {

55 map: GoogleMapInstance;

56 position: GoogleLatLng;

57 title: string;

Source & flagged code

6 flagged · loading source

dist/design_system/sections/index.jsView file

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2518

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2518

dist/design_system/components/DynamicFormFields.jsView file

2507patternName = google_api_key severity = high line = 2507 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2507

dist/design_system/elements/index.jsView file

2502patternName = google_api_key severity = high line = 2502 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/elements/index.js

dist/design_system/elements/index.jsView on unpkg · L2502

dist/index.jsView file

2544patternName = google_api_key severity = high line = 2544 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2544

src/design_system/elements/map/GoogleMap.tsxView file

71patternName = google_api_key severity = high line = 71 matchedText = const GO...48';

High

Secret Pattern

Google API key in src/design_system/elements/map/GoogleMap.tsx

src/design_system/elements/map/GoogleMap.tsxView on unpkg · L71

Findings

6 High2 Medium4 Low

HighHigh Secretdist/design_system/sections/index.js

HighSecret Patterndist/design_system/sections/index.js

HighSecret Patterndist/design_system/components/DynamicFormFields.js

HighSecret Patterndist/design_system/elements/index.js

HighSecret Patterndist/index.js

HighSecret Patternsrc/design_system/elements/map/GoogleMap.tsx

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/design_system/sections/index.jsView file

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

High Secret

Package contains a high-severity secret pattern.

dist/design_system/sections/index.jsView on unpkg · L2518

2518patternName = google_api_key severity = high line = 2518 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/design_system/sections/index.js

dist/design_system/sections/index.jsView on unpkg · L2518

dist/design_system/components/DynamicFormFields.jsView file

Lines 2487-2527javascript

2487var PaginationPageMinimalCenter = (_a) => {

2488 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"]);

2489 const isDesktop = useBreakpoint("md");

2490 return /* @__PURE__ */ React.createElement(

2491 Pagination.Root,

2492 __spreadProps(__spreadValues({}, props), {

2493 page,

2494 total,

2495 className: cx("flex w-full items-center justify-between gap-3 border-t border-secondary pt-4 md:pt-5", className)

2496 }),

2502 );

2503};

2504

2505// src/design_system/elements/map/GoogleMap.tsx

2506import { useEffect as useEffect3, useRef as useRef2, useState as useState4, useCallback as useCallback2 } from "react";

2507var GOOGLE_MAPS_API_KEY = "AIzaSyAb4-zSsPFx-QGi4cAiCGaRrzsAJC6e348";

High

Secret Pattern

Google API key in dist/design_system/components/DynamicFormFields.js

dist/design_system/components/DynamicFormFields.jsView on unpkg · L2507

2508function GoogleMap({ address, locationName, className = "" }) {

2509 const mapRef = useRef2(null);

2510 const [mapError, setMapError] = useState4(null);

2511 const [isLoaded, setIsLoaded] = useState4(false);

2512 const geocoderRef = useRef2(null);

2513 const mapInstanceRef = useRef2(null);

2514 const isInitializingRef = useRef2(false);

2515 const callbackNameRef = useRef2(null);

2516 const initMapRef = useRef2(null);

2517 const initMap = useCallback2(async () => {

2518 if (isInitializingRef.current) return;

2519 if (!mapRef.current || !window.google || !window.google.maps) {

2520 return;

2521 }

2522 if (!window.google.maps.Geocoder) {

2523 warn("google-map", "GEOCODER_NOT_READY_RETRYING", {

2524 address

2525 });

2526 setTimeout(() => {

2527 var _a, _b;

dist/design_system/elements/index.jsView file

Lines 2482-2522javascript

2482var PaginationPageMinimalCenter = (_a) => {

2483 var _b = _a, { rounded, page = 1, total = 10, className } = _b, props = __objRest(_b, ["rounded", "page", "total", "className"

dist/index.jsView file

2544patternName = google_api_key severity = high line = 2544 matchedText = var GOOG...48";

High

Secret Pattern

Google API key in dist/index.js

dist/index.jsView on unpkg · L2544

src/design_system/elements/map/GoogleMap.tsxView file

Lines 51-91tsx

51 markers?: GoogleMarker[];

52}

54interface GoogleMarkerOptions {

55 map: GoogleMapInstance;

56 position: GoogleLatLng;

57 title: string;