nitxui@2.3.4
The official UI component library for Nitx projects.
AI Security Review
scanned 16h ago · by lpm-firewall-aiThe component forwards broadly discovered browser credentials to an API destination that may be configurable, creating conditional credential exposure. The preference-change trigger and account-update purpose limit the evidence to a warning rather than establishing a malicious transfer.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user changes the language or theme in the account preferences component.
Impact
A token belonging to another service could be disclosed to the configured API recipient; the inspected source does not establish misuse of any received token.
Mechanism
The component searches cookies and storage for tokens, then includes a found token in an Authorization header on its update request.
AI rationale
The component forwards broadly discovered browser credentials to an API destination that may be configurable, creating conditional credential exposure. The preference-change trigger and account-update purpose limit the evidence to a warning rather than establishing a malicious transfer.
Evidence
dist/index.mjspackage.json
Network endpoints3
api.dev.nitx.appapi.nitx.appapi.nitx.io
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes an account preferences component through its runtime entry point.
- The component searches cookies and browser storage for generic session and access tokens.
- When no custom update callback or API client handles the request, it sends the discovered token in an Authorization header to a configurable API URL or a Nitx API default.
- Changing language or theme triggers the update request; the API URL and client can be supplied as component props.
Evidence against
- The transfer is tied to preference changes, and callers can provide a custom update callback or API client.
- The observed request updates language or display mode; the inspected source does not show a separate credential upload operation.
Behavioral surface
CryptoEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcedist/index.mjsView file
•Browser cookie sent to a fixed external endpoint in dist/index.mjs:
urlPlaceholder: "https://example.com",
urlPlaceholder: "https://example.com",
urlPlaceholder: "https://example.com",
urlPlaceholder: "https://example.com",
var profileIcon = "https://ui-avatars.com/api/?name=SALT&background=000&color=fff&rounded=true";
image: "https://cdn-new.nitx.app/nitx-assets/ProductLight/signage-icon.svg",
dark_image: "https://cdn-new.nitx.app/nitx-assets/productsIconDark/signage-dark.svg",
image: "https://cdn-new.nitx.app/nitx-assets/ProductLight/publisher-logo.svg",
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.mjsView on unpkg181patternName = generic_password
severity = medium
line = 181
Medium
186patternName = generic_password
severity = medium
line = 186
Medium
Findings
1 Critical1 High9 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.mjs
HighSemantic Analysis Limiteddist/styles.css
MediumSecret Patterndist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nitxui@2.3.4.
See all versions of nitxui for other recorded verdicts.
- Review the evidence and your use of nitxui@2.3.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.