registry / react-semaphor / 0.1.426

react-semaphor@0.1.426

Fully interactive and customizable dashboards for your apps.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The dashboard custom-visual feature can download and execute ES modules from a configured library URL. It can also evaluate configured dynamic renderer code in the browser.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A consumer configures and renders a custom-visual library URL or dynamic renderer.

Impact

A party controlling the configured visual URL or renderer can run JavaScript in the consuming dashboard's browser context.

Mechanism

Runtime remote module import and custom renderer evaluation.

Rationale

No evidence shows malicious installation, harvesting, persistence, or stealthy exfiltration. The package nevertheless exposes an unguarded remote/custom-code execution capability, so it warrants a warning rather than a block.

Evidence

package.jsondist/chunks/dashboard-JNK2ly_e.jsdist/chunks/code-editor-tfzm8LWW.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/chunks/dashboard-JNK2ly_e.js` dynamically imports `<configured URL>/index.js` via `new Function`.
The same bundle fetches `<configured URL>/manifest.json` and renders exported remote components.
`dist/chunks/code-editor-tfzm8LWW.js` validates then parses custom renderer source with `new Function`.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
No `child_process`, filesystem-read/write, shell-execution, or credential-file primitives were found.
No AI-agent control-surface paths, cookie access, or fixed suspicious exfiltration endpoint were found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 98 file(s), 4.71 MB of source, external domains: 127.0.0.1, bit.ly, docs.semaphor.cloud, drafts.csswg.org, github.com, lea.verou.me, opensource.org, semaphor-data-app.localhost, stackoverflow.com, tanstack.com, unpkg.com, www.chartjs.org, www.w3.org

Oversized source lightweight scan

dist/chunks/dashboard-JNK2ly_e.js3.32 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringstanstack.comwww.w3.org

dist/chunks/dashboard-ZoKNg47G.js4.85 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStrings

Source & flagged code

6 flagged

dist/chunks/code-editor-tfzm8LWW.jsView file

Lines 30-76javascript

30 * See the LICENSE file in the root directory of this source tree.

31 */const dm=Se.createLucideIcon("RotateCcw",[["path",{d:"M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8",key:"1357e3"}],["path",{d:"M3 3v5h5",key:"1xhq8a"}]]);/**

32 * @license lucide-react v0.453.0 - ISC

33 *

34 * This source code is licensed under the ISC license.

35 * See the LICENSE file in the root directory of this source tree.

36 */const fm=Se.createLucideIcon("SlidersHorizontal",[["line",{x1:"21",x2:"14",y1:"4",y2:"4",key:"obuewd"}],["line",{x1:"10",x2:"3",y1:"4",y2:"4",key:"1q6298"}],["line",{x1:"21",x2:"12",y1:"12",y2:"12",key:"1iu8h1"}],["line",{x1:"8",x2:

37 * @license lucide-react v0.453.0 - ISC

38 *

39 * This source code is licensed under the ISC license.

40 * See the LICENSE file in the root directory of this source tree.

41 */const pm=Se.createLucideIcon("Table2",[["path",{d:"M9 3H5a2 2 0 0 0-2 2v4m6-6h10a2 2 0 0 1 2 2v4M9 3v18m0 0h10a2 2 0 0 0 2-2V9M9 21H5a2 2 0 0 1-2-2V9m0 0h18",key:"gugj83"}]]);/**

42 * @license lucide-react v0.453.0 - ISC

43 *

44 * This source code is licensed under the ISC license.

45 * See the LICENSE file in the root directory of this source tree.

46 */const mm=Se.createLucideIcon("Type",[["polyline",{points:"4 7 4 4 20 4 20 7",key:"1nosan"}],["line",{x1:"9",x2:"15",y1:"20",y2:"20",key:"swin9y"}],["line",{x1:"12",x2:"12",y1:"4",y2:"20",key:"1tx1rr"}]]);/**

47 * @license lucide-react v0.453.0 - ISC

48 *

49 * This source code is licensed under the ISC license.

50 * See the LICENSE file in the root directory of this source tree.

51 */const hm=Se.createLucideIcon("Upload",[["path",{d:"M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4",key:"ih7n3h"}],["polyline",{points:"17 8 12 3 7 8",key:"t8dd8p"}],["line",{x1:"12",x2:"12",y1:"3",y2:"15",key:"widbto"}]]);function Cs(e,n){if(typeof e=="function")

52`),i=o.findIndex(s=>s.includes("api.setState"));if(i<0)return;const a=((n=o[i+1])==null?void 0:n.trim())||"";return((t=Zm.exec(a))==null?void 0:t[1])||((r=Jm.exec(a))==null?void 0:r[1])}const th=(e,n={})=>(t,r,o)=>{const{enabled:i,anonymousActionType:a,store:s,...l}=n;let c;try{c=(i??(Ps?"production":void 0)!=="production")&&window.__REDUX_DEVTOOLS_EXTENSION__}catch{}if(!c)return e(t,r,o);const{connection:u,...d}=Xm(s,c,l);let f=!0;o.setState=(m,v,C)=>{const g=t(m,v);if(!f)return g;const y=C===void 0?{type:a||eh(new Error().stack)||"anonymous"}:typeof C=="string"?{type:C}:C;return s===void 0?( ...

53 [zustand devtools middleware] Unsupported __setState action format.

54 When using 'store' option in devtools(), the 'state' should have only one key, which is a value of 'store' that was passed in devtools(),

55 and value of this only key should be a state object. Example: { "type": "__setState", "state": { "abc123Store": { "foo": "bar" } } }

57`;)t+=1;return t}function Qc(e,n){let t=n+2;for(;t<e.length-1;){if(e[t]==="*"&&e[t+1]==="/")return t+1;t+=1}return e.length-1}function Zc(e,n,t,r){let o=1,i=n+1;for(;i<e.length;){const a=e[i],s=e[i+1];if(a==='"'||a==="'"||a==="`"){i=Kc(e,i,a),i+=1;continue}if(a==="/"&&s==="/"){i=Xc(e,i),i+=1;continue}if(a==="/"&&s==="*"){i=Qc(e,i),i+=1;continue}if(a===t)o+=1;else if(a===r&&(o-=1,o===0))return i;i+=1}return e.length-1}function Hy(e){const n=zy(e),t=n.indexOf("{");if(t<0)return null;const r=Zc(n,t,"{","}");return r<=t?null:n.slice(t+1,r)}function Gy(e){const n=[];let t=0,r=0,o=0,i=0,a=0;for(;a<e ...

58 .`.concat(vw,` {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg · L50

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg · L56

59 overflow: hidden `).concat(r,`;

60 padding-right: `).concat(s,"px ").concat(r,`;

61 }

62 body[`).concat(sn,`] {

63 overflow: hidden `).concat(r,`;

64 overscroll-behavior: contain;

65 `).concat([n&&"position: relative ".concat(r,";"),t==="margin"&&`

66 padding-left: `.concat(o,`px;

67 padding-top: `).concat(i,`px;

68 padding-right: `).concat(a,`px;

69 margin-left:0;

70 margin-top:0;

71 margin-right: `).concat(s,"px ").concat(r,`;

72 `),t==="padding"&&"padding-right: ".concat(s,"px ").concat(r,";")].filter(Boolean).join(""),`

73 }

75 .`).concat(_r,` {

76 right: `).concat(s,"px ").concat(r,`;

Long lines were clipped for display.

Lines 116-139javascript

116 }

117

118 .`).concat(Or,`::selection {

119 background-color: #accef7 !important;

120 color: transparent !important;

121 }

122}

123`),hE=De.forwardRef(function(n,t){var r=n.autoFocus,o=n.disabled,i=n.form,a=n.highlight,s=n.ignoreTabKey,l=s===void 0?!1:s,c=n.insertSpaces,u=c===void 0?!0:c,d=n.maxLength,f=n.minLength,h=n.name,b=n.onBlur,m=n.onClick,v=n.onFocus,C=n.onKeyDown,g=n.onKeyUp,y=n.onValueChange,S=n.padding,w=S===void 0?0:S,I=n.placeholder,E=n.preClassName,F=n.readOnly,T=n.required,D=n.style,R=n.tabSize,_=R===void 0?2:R,O=n.textareaClassName,V=n.textareaId,G=n.value,N=cE(n,["autoFocus","disabled","form","highlight","ignoreTabKey","insertSpaces","maxLength","minLength","name","onBlur","onClick","onFocus","onKeyDown", ...

124`

•matchType = previous_version_dangerous_delta matchedPackage = react-semaphor@0.1.424 matchedIdentity = npm:cmVhY3Qtc2VtYXBob3I:0.1.424 similarity = 0.652 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg

dist/types/index.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("../chunks/common-types-C73-Ud1-.js"),a={mode:"all"},E={tz:"UTC",weekStart:1,anchor:"now"};exports.CALCULATED_FIELD_ENTITY_MARKER=e.CALCULATED_FIELD_ENTITY_MARKER;exports.

dist/chunks/dashboard-ZoKNg47G.jsView file

•path = dist/chunks/dashboard-ZoKNg47G.js kind = oversized_source_file sizeBytes = 5081384 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/dashboard-ZoKNg47G.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/chunks/code-editor-tfzm8LWW.jsView file

136*/var t=function(r){var o=/(?:^|\s)lang(?:uage)?-([\w-]+)(?=\s|$)/i,i=0,a={},s={manual:r.Prism&&r.Prism.manual,disableWorkerMessageHandler:r.Prism&&r.Prism.disableWorkerMessageHand... L137: `),v.hasAttribute("data-start")||v.setAttribute("data-start",String(T+1))}C.textContent=I,t.highlightElement(C)},function(I){v.setAttribute(s,u),C.textContent=I})}}),t.plugins.file... L138: `).length,[e]),v=Math.max(2,String(m).length),C=Ee.useId(),g=h??C,y=u??c;return x.jsxs("div",{className:`code-editor relative h-full min-h-0 overflow-auto font-mono text-[12px] lea...

High

Child Process

Package source references child process execution.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg · L136

50* See the LICENSE file in the root directory of this source tree. L51: */const hm=Se.createLucideIcon("Upload",[["path",{d:"M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4",key:"ih7n3h"}],["polyline",{points:"17 8 12 3 7 8",key:"t8dd8p"}],["line",{x1:"12",x... L52: `),i=o.findIndex(s=>s.includes("api.setState"));if(i<0)return;const a=((n=o[i+1])==null?void 0:n.trim())||"";return((t=Zm.exec(a))==null?void 0:t[1])||((r=Jm.exec(a))==null?void 0:... ... L56: `);const g=C.state[s];if(g==null)return;JSON.stringify(o.getState())!==JSON.stringify(g)&&h(g);return}Os(o)&&o.dispatch(C)});case"DISPATCH":switch(m.payload.type){case"RESET":retur... L57: `;)t+=1;return t}function Qc(e,n){let t=n+2;for(;t<e.length-1;){if(e[t]==="*"&&e[t+1]==="/")return t+1;t+=1}return e.length-1}function Zc(e,n,t,r){let o=1,i=n+1;for(;i<e.length;){c... L58: .`.concat(vw,` {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg · L50

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg

56`);const g=C.state[s];if(g==null)return;JSON.stringify(o.getState())!==JSON.stringify(g)&&h(g);return}Os(o)&&o.dispatch(C)});case"DISPATCH":switch(m.payload.type){case"RESET":retur... L57: `;)t+=1;return t}function Qc(e,n){let t=n+2;for(;t<e.length-1;){if(e[t]==="*"&&e[t+1]==="/")return t+1;t+=1}return e.length-1}function Zc(e,n,t,r){let o=1,i=n+1;for(;i<e.length;){c... L58: .`.concat(vw,` {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg · L56

dist/types/index.cjsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("../chunks/common-types-C73-Ud1-.js"),a={mode:"all"},E={tz:"UTC",weekStart:1,anchor:...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types/index.cjsView on unpkg · L1

dist/chunks/dashboard-ZoKNg47G.jsView file

•path = dist/chunks/dashboard-ZoKNg47G.js kind = oversized_source_file sizeBytes = 5081384 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/dashboard-ZoKNg47G.jsView on unpkg

Findings

4 High4 Medium5 Low

HighChild Processdist/chunks/code-editor-tfzm8LWW.js

HighSame File Env Network Executiondist/chunks/code-editor-tfzm8LWW.js

HighOversized Source Filedist/chunks/dashboard-ZoKNg47G.js

HighPrevious Version Dangerous Deltadist/chunks/code-editor-tfzm8LWW.js

MediumDynamic Requiredist/types/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunks/code-editor-tfzm8LWW.js

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeRemote Code Execution

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorSemaphor

Maintainersrohitspujari

Version0.1.428

PublishedJul 14, 2026

LicenseMIT

Dependencies81

Integrityverified

Package size3.41 MB

Files126

Keywordsreactsemaphoranalyticscustomizable dashboards

Runtime surface

package.json

Entrypointsmain → dist/index.cjsmodule → dist/index.jstypes → dist/types/main.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact14.0 MB · 126 files1 signature(s)

Install lifecycleNo install hooks · other: build, deploy, deploy:major, deploy:minor +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalNetworkHighEntropyStringsMinifiedTelemetryUrlStringsManifest: clean

Source & flagged code

6 flagged

dist/chunks/code-editor-tfzm8LWW.jsView file

Lines 30-76javascript

30 * See the LICENSE file in the root directory of this source tree.

31 */const dm=Se.createLucideIcon("RotateCcw",[["path",{d:"M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8",key:"1357e3"}],["path",{d:"M3 3v5h5",key:"1xhq8a"}]]);/**

32 * @license lucide-react v0.453.0 - ISC

33 *

34 * This source code is licensed under the ISC license.

35 * See the LICENSE file in the root directory of this source tree.

37 * @license lucide-react v0.453.0 - ISC

38 *

39 * This source code is licensed under the ISC license.

40 * See the LICENSE file in the root directory of this source tree.

41 */const pm=Se.createLucideIcon("Table2",[["path",{d:"M9 3H5a2 2 0 0 0-2 2v4m6-6h10a2 2 0 0 1 2 2v4M9 3v18m0 0h10a2 2 0 0 0 2-2V9M9 21H5a2 2 0 0 1-2-2V9m0 0h18",key:"gugj83"}]]);/**

42 * @license lucide-react v0.453.0 - ISC

43 *

44 * This source code is licensed under the ISC license.

45 * See the LICENSE file in the root directory of this source tree.

47 * @license lucide-react v0.453.0 - ISC

48 *

49 * This source code is licensed under the ISC license.

50 * See the LICENSE file in the root directory of this source tree.

53 [zustand devtools middleware] Unsupported __setState action format.

54 When using 'store' option in devtools(), the 'state' should have only one key, which is a value of 'store' that was passed in devtools(),

55 and value of this only key should be a state object. Example: { "type": "__setState", "state": { "abc123Store": { "foo": "bar" } } }

58 .`.concat(vw,` {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg · L50

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg · L56

59 overflow: hidden `).concat(r,`;

60 padding-right: `).concat(s,"px ").concat(r,`;

61 }

62 body[`).concat(sn,`] {

63 overflow: hidden `).concat(r,`;

64 overscroll-behavior: contain;

65 `).concat([n&&"position: relative ".concat(r,";"),t==="margin"&&`

66 padding-left: `.concat(o,`px;

67 padding-top: `).concat(i,`px;

68 padding-right: `).concat(a,`px;

69 margin-left:0;

70 margin-top:0;

71 margin-right: `).concat(s,"px ").concat(r,`;

72 `),t==="padding"&&"padding-right: ".concat(s,"px ").concat(r,";")].filter(Boolean).join(""),`

73 }

75 .`).concat(_r,` {

76 right: `).concat(s,"px ").concat(r,`;

Long lines were clipped for display.

Lines 116-139javascript

116 }

117

118 .`).concat(Or,`::selection {

119 background-color: #accef7 !important;

120 color: transparent !important;

121 }

122}

124`

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/code-editor-tfzm8LWW.jsView on unpkg

dist/types/index.cjsView file

Lines 1-2javascript

dist/chunks/dashboard-ZoKNg47G.jsView file

•path = dist/chunks/dashboard-ZoKNg47G.js kind = oversized_source_file sizeBytes = 5081384 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/dashboard-ZoKNg47G.jsView on unpkg