registry / react-semaphor / 0.1.424

react-semaphor@0.1.424

Fully interactive and customizable dashboards for your apps.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Host application renders the Data App Builder in bridge mode while a local bridge is reachable.

Impact

A reachable trusted local bridge could receive credentials and perform workspace operations requested through the builder; the bridge implementation is not packaged here.

Mechanism

Browser POSTs authenticated project context and workspace instructions to a localhost bridge.

Rationale

Source inspection found no concrete malware, persistence, credential harvesting, or install-time mutation. The package nevertheless ships an enabled local-bridge and dynamic-code authoring capability, so it warrants a warning as dangerous dual-use functionality rather than a block.

Evidence

package.jsondist/data-app-builder/index.jsdist/chunks/index-Dzz6jXSY.jsdist/chunks/switch-DMT7qf_R.js

Network endpoints2

semaphor-data-app.localhost:8088localhost:8787

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/data-app-builder/index.js` defaults to a local bridge at `http://localhost:8787` and a workspace path.
Rendering the builder POSTs access token and project context to `/runtime-context`.
Builder invokes local-bridge operations including source restore and `/publish-build`.
Dynamic visual/component loading uses `new Function` and URL-based `import()` in runtime chunks.

Evidence against

`package.json` has no preinstall, install, postinstall, prepare, or bin entry.
No Node child-process, filesystem, shell, or native-module imports were found in `dist`.
Network calls target configured Semaphor APIs or the explicit local bridge; no covert external endpoint was found.
Dynamic-code paths are dashboard/data-app authoring features, not install-time behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 92 file(s), 4.61 MB of source, external domains: 127.0.0.1, bit.ly, docs.semaphor.cloud, drafts.csswg.org, github.com, semaphor-data-app.localhost, stackoverflow.com, tanstack.com, unpkg.com, www.chartjs.org, www.w3.org

Oversized source lightweight scan

dist/chunks/index-Dzz6jXSY.js4.79 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringstanstack.com

dist/chunks/index-S1CGUcSz.js3.28 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringstanstack.comwww.w3.org

Source & flagged code

5 flagged

dist/chunks/switch-DMT7qf_R.jsView file

Lines 1-26javascript

1"use strict";const ve=require("./x-B6ghREd2.js"),x=require("react/jsx-runtime"),le=require("react");require("./analyze-result-contract-DpDcImgk.js");const pl=require("react-dom"),ut=require("./index-DRlMUglg.js");require("react-dom/client");const Pi=require("./catalog-field-grounding-Bnx-3tE0.js"),vp=require("../layouts/index.cjs"),he=require("./index-D7KJindZ.js"),ml=require("./card-config-utils-15sRtebL.js"),xn=require("./common-types-C73-Ud1-.js");function hl(e){const r=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(e){for(const t in e)if(t!=="default"){const n=Object.getOwn ...

2`),o=n.findIndex(a=>a.includes("api.setState"));if(o<0)return;const i=((r=n[o+1])==null?void 0:r.trim())||"";return(t=/.+ (.+) .+/.exec(i))==null?void 0:t[1]},Gp=(e,r={})=>(t,n,o)=>{const{enabled:i,anonymousActionType:a,store:s,...l}=r;let c;try{c=(i??(ts?"production":void 0)!=="production")&&window.__REDUX_DEVTOOLS_EXTENSION__}catch{}if(!c)return e(t,n,o);const{connection:u,...d}=qp(s,c,l);let p=!0;o.setState=(m,b,S)=>{const g=t(m,b);if(!p)return g;const y=S===void 0?{type:a||Wp(new Error().stack)||"anonymous"}:typeof S=="string"?{type:S}:S;return s===void 0?(u==null||u.send(y,n()),g):(u==nul ...

3 [zustand devtools middleware] Unsupported __setState action format.

4 When using 'store' option in devtools(), the 'state' should have only one key, which is a value of 'store' that was passed in devtools(),

5 and value of this only key should be a state object. Example: { "type": "__setState", "state": { "abc123Store": { "foo": "bar" } } }

7`;)t+=1;return t}function pc(e,r){let t=r+2;for(;t<e.length-1;){if(e[t]==="*"&&e[t+1]==="/")return t+1;t+=1}return e.length-1}function mc(e,r,t,n){let o=1,i=r+1;for(;i<e.length;){const a=e[i],s=e[i+1];if(a==='"'||a==="'"||a==="`"){i=dc(e,i,a),i+=1;continue}if(a==="/"&&s==="/"){i=fc(e,i),i+=1;continue}if(a==="/"&&s==="*"){i=pc(e,i),i+=1;continue}if(a===t)o+=1;else if(a===n&&(o-=1,o===0))return i;i+=1}return e.length-1}function _g(e){const r=Rg(e),t=r.indexOf("{");if(t<0)return null;const n=mc(r,t,"{","}");return n<=t?null:r.slice(t+1,n)}function Og(e){const r=[];let t=0,n=0,o=0,i=0,a=0;for(;a<e ...

8 * @license lucide-react v0.453.0 - ISC

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/switch-DMT7qf_R.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/switch-DMT7qf_R.jsView on unpkg · L6

9 *

10 * This source code is licensed under the ISC license.

11 * See the LICENSE file in the root directory of this source tree.

12 */const $v=ve.createLucideIcon("ChartColumn",[["path",{d:"M3 3v16a2 2 0 0 0 2 2h16",key:"c24i48"}],["path",{d:"M18 17V9",key:"2bz60n"}],["path",{d:"M13 17V5",key:"1frdt8"}],["path",{d:"M8 17v-3",key:"17ska0"}]]);/**

13 * @license lucide-react v0.453.0 - ISC

14 *

15 * This source code is licensed under the ISC license.

16 * See the LICENSE file in the root directory of this source tree.

17 */const lu=ve.createLucideIcon("Check",[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]]);/**

18 * @license lucide-react v0.453.0 - ISC

19 *

20 * This source code is licensed under the ISC license.

21 * See the LICENSE file in the root directory of this source tree.

22 */const cu=ve.createLucideIcon("ChevronUp",[["path",{d:"m18 15-6-6-6 6",key:"153udz"}]]);/**

23 * @license lucide-react v0.453.0 - ISC

24 *

25 * This source code is licensed under the ISC license.

26 * See the LICENSE file in the root directory of this source tree.

Long lines were clipped for display.

Lines 116-139javascript

116 }

117

118 .`).concat(Sn,`::selection {

119 background-color: #accef7 !important;

120 color: transparent !important;

121 }

122}

123`),tI=Ae.forwardRef(function(r,t){var n=r.autoFocus,o=r.disabled,i=r.form,a=r.highlight,s=r.ignoreTabKey,l=s===void 0?!1:s,c=r.insertSpaces,u=c===void 0?!0:c,d=r.maxLength,p=r.minLength,h=r.name,v=r.onBlur,m=r.onClick,b=r.onFocus,S=r.onKeyDown,g=r.onKeyUp,y=r.onValueChange,C=r.padding,w=C===void 0?0:C,I=r.placeholder,E=r.preClassName,A=r.readOnly,T=r.required,D=r.style,R=r.tabSize,P=R===void 0?2:R,O=r.textareaClassName,L=r.textareaId,H=r.value,N=Kw(r,["autoFocus","disabled","form","highlight","ignoreTabKey","insertSpaces","maxLength","minLength","name","onBlur","onClick","onFocus","onKeyDown", ...

124`

dist/types/index.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("../chunks/common-types-C73-Ud1-.js"),a={mode:"all"},E={tz:"UTC",weekStart:1,anchor:"now"};exports.CALCULATED_FIELD_ENTITY_MARKER=e.CALCULATED_FIELD_ENTITY_MARKER;exports.

dist/chunks/index-Dzz6jXSY.jsView file

•path = dist/chunks/index-Dzz6jXSY.js kind = oversized_source_file sizeBytes = 5021897 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/index-Dzz6jXSY.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/chunks/switch-DMT7qf_R.jsView file

136*/var t=function(n){var o=/(?:^|\s)lang(?:uage)?-([\w-]+)(?=\s|$)/i,i=0,a={},s={manual:n.Prism&&n.Prism.manual,disableWorkerMessageHandler:n.Prism&&n.Prism.disableWorkerMessageHand... L137: `),b.hasAttribute("data-start")||b.setAttribute("data-start",String(T+1))}S.textContent=I,t.highlightElement(S)},function(I){b.setAttribute(s,u),S.textContent=I})}}),t.plugins.file... L138: `).length,[e]),b=Math.max(2,String(m).length),S=le.useId(),g=h??S,y=u??c;return x.jsxs("div",{className:`code-editor relative h-full min-h-0 overflow-auto font-mono text-[12px] lea...

High

Child Process

Package source references child process execution.

dist/chunks/switch-DMT7qf_R.jsView on unpkg · L136

1"use strict";const ve=require("./x-B6ghREd2.js"),x=require("react/jsx-runtime"),le=require("react");require("./analyze-result-contract-DpDcImgk.js");const pl=require("react-dom"),u... L2: `),o=n.findIndex(a=>a.includes("api.setState"));if(o<0)return;const i=((r=n[o+1])==null?void 0:r.trim())||"";return(t=/.+ (.+) .+/.exec(i))==null?void 0:t[1]},Gp=(e,r={})=>(t,n,o)=... ... L6: `);const g=S.state[s];if(g==null)return;JSON.stringify(o.getState())!==JSON.stringify(g)&&h(g);return}o.dispatchFromDevtools&&typeof o.dispatch=="function"&&o.dispatch(S)});case"DI... L7: `;)t+=1;return t}function pc(e,r){let t=r+2;for(;t<e.length-1;){if(e[t]==="*"&&e[t+1]==="/")return t+1;t+=1}return e.length-1}function mc(e,r,t,n){let o=1,i=r+1;for(;i<e.length;){c... L8: * @license lucide-react v0.453.0 - ISC

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/switch-DMT7qf_R.jsView on unpkg · L1

6`);const g=S.state[s];if(g==null)return;JSON.stringify(o.getState())!==JSON.stringify(g)&&h(g);return}o.dispatchFromDevtools&&typeof o.dispatch=="function"&&o.dispatch(S)});case"DI... L7: `;)t+=1;return t}function pc(e,r){let t=r+2;for(;t<e.length-1;){if(e[t]==="*"&&e[t+1]==="/")return t+1;t+=1}return e.length-1}function mc(e,r,t,n){let o=1,i=r+1;for(;i<e.length;){c... L8: * @license lucide-react v0.453.0 - ISC

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/switch-DMT7qf_R.jsView on unpkg · L6

dist/types/index.cjsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("../chunks/common-types-C73-Ud1-.js"),a={mode:"all"},E={tz:"UTC",weekStart:1,anchor:...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types/index.cjsView on unpkg · L1

dist/chunks/index-Dzz6jXSY.jsView file

•path = dist/chunks/index-Dzz6jXSY.js kind = oversized_source_file sizeBytes = 5021897 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/index-Dzz6jXSY.jsView on unpkg

Findings

3 High4 Medium5 Low

HighChild Processdist/chunks/switch-DMT7qf_R.js

HighSame File Env Network Executiondist/chunks/switch-DMT7qf_R.js

HighOversized Source Filedist/chunks/index-Dzz6jXSY.js

MediumDynamic Requiredist/types/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunks/switch-DMT7qf_R.js

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

86%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorSemaphor

Maintainersrohitspujari

Version0.1.428

PublishedJul 11, 2026

LicenseMIT

Dependencies81

Integrityverified

Package size3.35 MB

Files120

Keywordsreactsemaphoranalyticscustomizable dashboards

Runtime surface

package.json

Entrypointsmain → dist/index.cjsmodule → dist/index.jstypes → dist/types/main.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact13.7 MB · 120 files1 signature(s)

Install lifecycleNo install hooks · other: build, deploy, deploy:major, deploy:minor +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalNetworkHighEntropyStringsMinifiedTelemetryUrlStringsManifest: clean

Source & flagged code

5 flagged

dist/chunks/switch-DMT7qf_R.jsView file

Lines 1-26javascript

3 [zustand devtools middleware] Unsupported __setState action format.

4 When using 'store' option in devtools(), the 'state' should have only one key, which is a value of 'store' that was passed in devtools(),

5 and value of this only key should be a state object. Example: { "type": "__setState", "state": { "abc123Store": { "foo": "bar" } } }

8 * @license lucide-react v0.453.0 - ISC

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/switch-DMT7qf_R.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/switch-DMT7qf_R.jsView on unpkg · L6

9 *

10 * This source code is licensed under the ISC license.

11 * See the LICENSE file in the root directory of this source tree.

13 * @license lucide-react v0.453.0 - ISC

14 *

15 * This source code is licensed under the ISC license.

16 * See the LICENSE file in the root directory of this source tree.

17 */const lu=ve.createLucideIcon("Check",[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]]);/**

18 * @license lucide-react v0.453.0 - ISC

19 *

20 * This source code is licensed under the ISC license.

21 * See the LICENSE file in the root directory of this source tree.

22 */const cu=ve.createLucideIcon("ChevronUp",[["path",{d:"m18 15-6-6-6 6",key:"153udz"}]]);/**

23 * @license lucide-react v0.453.0 - ISC

24 *

25 * This source code is licensed under the ISC license.

26 * See the LICENSE file in the root directory of this source tree.

Long lines were clipped for display.

Lines 116-139javascript

116 }

117

118 .`).concat(Sn,`::selection {

119 background-color: #accef7 !important;

120 color: transparent !important;

121 }

122}

124`

dist/types/index.cjsView file

Lines 1-2javascript

dist/chunks/index-Dzz6jXSY.jsView file

•path = dist/chunks/index-Dzz6jXSY.js kind = oversized_source_file sizeBytes = 5021897 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/index-Dzz6jXSY.jsView on unpkg