registry / proto-plugin / 0.1.27

proto-plugin@0.1.27

Shared framework for building shareable UI prototypes in Next.js — review shell, comment anchoring, variant exploration, and the prototype home gallery.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 274 file(s), 1.10 MB of source, external domains: api.github.com, docs.google.com, mobbin.com, poetic-martin-83530.upstash.io, registry.npmjs.org, vercel.com, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 15-55json

15 "src",

16 "scripts",

17 "README.md",

18 "AGENTS.md",

19 "components.json",

20 "tsconfig.json"

21 ],

22 "main": "./src/index.ts",

23 "types": "./src/index.ts",

24 "exports": {

25 ".": "./src/index.ts",

26 "./config": "./src/config/define-prototype-config.ts",

27 "./config/prototype-icon": "./src/config/prototype-icon.tsx",

28 "./app": "./src/app.ts",

29 "./with-prototype": "./src/config/with-prototype.ts",

30 "./server": "./src/server.ts",

31 "./ui/*": "./src/components/ui/*.tsx",

32 "./styles/globals.css": "./src/styles/globals.css"

33 },

34 "scripts": {

35 "postinstall": "node scripts/ensure-component-library-page.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "setup-host": "node scripts/ensure-component-library-page.mjs",

37 "verify:prototype-ids": "node scripts/verify-prototype-component-ids.mjs",

38 "verify:prototype-preview-states": "node scripts/verify-prototype-preview-states.mjs",

39 "link-source": "./scripts/link-source.sh",

40 "sync-from-source": "./scripts/sync-from-source.sh",

41 "link-source-db": "./scripts/link-source-db.sh",

42 "share-prototype": "./scripts/share-prototype.sh",

43 "download-mobbin-references": "node scripts/download-mobbin-reference-images.mjs",

44 "publish-package": "./scripts/publish-package.sh"

45 },

46 "peerDependencies": {

47 "next": ">=15",

48 "next-themes": ">=0.4",

49 "react": ">=19",

50 "react-dom": ">=19"

51 },

52 "dependencies": {

53 "@radix-ui/react-dialog": "^1.1.15",

54 "@radix-ui/react-dropdown-menu": "^2.1.16",

55 "@radix-ui/react-label": "^2.1.8",

scripts/publish-package.shView file

•path = scripts/publish-package.sh kind = build_helper sizeBytes = 5037 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/publish-package.shView on unpkg

src/server/pr-vercel-preview-route.tsView file

•matchType = normalized_sha256 matchedPackage = proto-plugin@0.1.23 matchedPath = src/server/pr-vercel-preview-route.ts matchedIdentity = npm:cHJvdG8tcGx1Z2lu:0.1.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/server/pr-vercel-preview-route.tsView on unpkg

src/lib/prototype-comments/core/source-location.tsView file

•matchType = normalized_sha256 matchedPackage = proto-plugin@0.1.23 matchedPath = src/lib/prototype-comments/core/source-location.ts matchedIdentity = npm:cHJvdG8tcGx1Z2lu:0.1.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/lib/prototype-comments/core/source-location.tsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code