nitxui@2.3.3
The official UI component library for Nitx projects.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe credential transfer is tied to user preference changes, but the configurable endpoint is unrestricted and the helper automatically attaches detected credentials. This supports a warning for conditional credential exposure, not a confirmed malicious attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user changes the language or appearance setting in the account preferences UI.
Impact
If the configured endpoint is unrelated to the token's service, that endpoint receives the credential.
Mechanism
The component searches cookies and browser storage for tokens, then sends one as an Authorization header with credentials included to the configured API endpoint.
AI rationale
The credential transfer is tied to user preference changes, but the configurable endpoint is unrestricted and the helper automatically attaches detected credentials. This supports a warning for conditional credential exposure, not a confirmed malicious attack.
Evidence
dist/index.mjs
Network endpoints3
api.dev.nitx.appapi.nitx.appapi.nitx.io
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package imports dist/index.mjs as its entrypoint.
- Changing language or appearance invokes the account update helper.
- The helper reads recognized cookies and scans browser storage for access tokens.
- The helper accepts a configurable API URL and sends the detected token to the selected endpoint.
- On hosts outside the Nitx domains, the default endpoint is api.dev.nitx.app.
- A caller can instead provide an update callback or API client.
Evidence against
Behavioral surface
CryptoEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcedist/index.mjsView file
•Browser cookie sent to a fixed external endpoint in dist/index.mjs:
urlPlaceholder: "https://example.com",
urlPlaceholder: "https://example.com",
urlPlaceholder: "https://example.com",
urlPlaceholder: "https://example.com",
var profileIcon = "https://ui-avatars.com/api/?name=SALT&background=000&color=fff&rounded=true";
image: "https://cdn-new.nitx.app/nitx-assets/ProductLight/signage-icon.svg",
dark_image: "https://cdn-new.nitx.app/nitx-assets/productsIconDark/signage-dark.svg",
image: "https://cdn-new.nitx.app/nitx-assets/ProductLight/publisher-logo.svg",
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.mjsView on unpkg181patternName = generic_password
severity = medium
line = 181
Medium
186patternName = generic_password
severity = medium
line = 186
Medium
Findings
1 Critical1 High9 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.mjs
HighSemantic Analysis Limiteddist/styles.css
MediumSecret Patterndist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nitxui@2.3.3.
See all versions of nitxui for other recorded verdicts.
- Review the evidence and your use of nitxui@2.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.