registry / react-photo-frame / 3.0.3

react-photo-frame@3.0.3

Give it a frame design and a photo, and it draws the photo inside the frame's border on a canvas, then hands back the combined image as a data URL.

AI Security Review

scanned 14h ago · by lpm-firewall-ai

Importing and mounting the component starts a hidden remote licence check. A remote revocation result can make the component attempt to replace the host document root.

Static reason

One or more suspicious static signals were detected.

Trigger

A React application mounts the default PhotoFrame component.

Impact

A third-party endpoint can cause the consumer page to fail or be disrupted.

Mechanism

Remote licence kill switch with document-root replacement.

Rationale

The package has no install hook or data-exfiltration path, but its obfuscated runtime code contains an undisclosed remote kill switch that can disrupt the host page. This is a concrete runtime risk requiring a warning, not enough evidence of malware.

Evidence

index.js

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The obfuscated browser entrypoint performs a remote licence-revocation check on component mount.
A revoked or invalid licence causes the component to replace the document root, which can break the host application.

react-photo-frame@3.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code