registry  /  md-components-mdigial-azamat  /  0.0.313

md-components-mdigial-azamat@0.0.313

npm version patch npm run build npm publish

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Runtime network behavior is package-aligned form/media/module API usage for a banking component library, plus optional consumer-configured endpoints.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User renders/submits specific React components
Impact
Form submission/media/module data exchange with configured application APIs; no evidence of exfiltration or persistence
Mechanism
runtime UI API calls and calculator expression evaluation
Rationale
Static inspection shows a built React UI/component package with package-aligned runtime API calls and no install-time payload, persistence, credential theft, or agent-control mutation. Scanner hits are explained by bundled fonts/assets, normal browser fetch usage, styled-components process.env checks, calculator formula evaluation, and benign invisible Unicode in bundled editor code.
Evidence
package.jsondist/main.jsdist/CustomCalculator/hooks/useCalculator.jsdist/Forms/FormDefault/hooks/useFormSubmission.jsdist/ModuleArm/components/MediaUrlField.jsdist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.js
Network endpoints7
mbank.kg/constructor-api/api/v1/constructor/form-submissions/mbank.kg/constructor-apimbank.kg/api/murabaha.mbank.kg/callback/api/v1/region/getAllRegionsmurabaha.mbank.kg/callback/api/v1/percent/getBusinessPercentmurabaha.mbank.kg/callback/api/v1/percent/getPotrebPercentwww.google.com/recaptcha/api.js

Decision evidence

public snapshot
AI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json has no preinstall/install/postinstall hook; prepare is only "husky" with no shipped .husky files found
    • dist/main.js is a React component library export barrel with static imports/exports
    • dist/CustomCalculator/hooks/useCalculator.js uses new Function only to evaluate configured calculator expressions from component data
    • dist/Forms/FormDefault/hooks/useFormSubmission.js posts form data to mbank.kg constructor API and optional user-configured submit URLs at runtime
    • dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.js invisible Unicode occurs in ProseMirror text/docs/constants, not hidden control-flow
    • No child_process, fs writes, AI-agent control-surface writes, credential harvesting, or import-time execution found
    Behavioral surface
    Source
    ChildProcessEnvironmentVarsEvalNetwork
    Supply chain
    HighEntropyStringsMinifiedUrlStrings
    Manifest
    NoLicense
    scanned 855 file(s), 2.75 MB of source, external domains: api.example.com, api.whatsapp.com, app.mbank.kg, apps.apple.com, cdn-icons-png.flaticon.com, cdn.tailwindcss.com, developer.mozilla.org, example.com, facebook.com, fb.me, github.com, hub.mbank.kg, images.unsplash.com, img.youtube.com, instagram.com, linkedin.com, mbank.kg, murabaha.mbank.kg, picsum.photos, play.google.com, prosemirror.net, s-c.sh, styled-components.com, t.me, upload.wikimedia.org, w3c.github.io, wallpapercave.com, www.google.com, www.styled-components.com, www.w3.org, www.youtube.com

    Source & flagged code

    3 flagged · loading source
    dist/CustomCalculator/hooks/useCalculator.jsView file
    204try { L205: t[e.id] = new Function(...n, `return ${e.expression}`); L206: } catch {
    Low
    Eval

    Package source references a known benign dynamic code generation pattern.

    dist/CustomCalculator/hooks/useCalculator.jsView on unpkg · L204
    dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView file
    1557contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite
    Critical
    Trojan Source Unicode

    Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

    dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView on unpkg · L1557
    dist/assets/Inter-Medium.woff2View file
    •path = dist/assets/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 108096 magicHex = [redacted]
    High
    Ships High Entropy Blob

    Package ships high-entropy non-source blobs.

    dist/assets/Inter-Medium.woff2View on unpkg

    Findings

    1 Critical1 High3 Medium6 Low
    CriticalTrojan Source Unicodedist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.js
    HighShips High Entropy Blobdist/assets/Inter-Medium.woff2
    MediumNetwork
    MediumEnvironment Vars
    MediumStructural Risk Force Deep Review
    LowNon Install Lifecycle Scripts
    LowScripts Present
    LowEvaldist/CustomCalculator/hooks/useCalculator.js
    LowHigh Entropy Strings
    LowUrl Strings
    LowNo License