registry / snice / 6.0.0

snice@6.0.0

A decorator-driven web component library with differential rendering, routing, controllers, and 130+ ready-made UI components. Use as much or as little as you want. Zero dependencies, works anywhere.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 857 file(s), 17.2 MB of source, external domains: api.example.com, example.com, fastly.jsdelivr.net, i.pravatar.cc, maps.apple.com, ns.adobe.com, tile.openstreetmap.org, www.google.com, www.itunes.com, www.openstreetmap.org, www.w3.org, www.xfa.org

Source & flagged code

9 flagged

bin/templates/default/src/services/auth.tsView file

Lines 1-33typescript

1import type { LoginCredentials, LoginResponse, User } from '../types/auth';

2import { setToken, setUser, clearToken, getToken } from './storage';

3import { isTokenExpired } from './jwt';

5// Mock API - replace with real API calls

6const MOCK_USER: User = {

7 id: '1',

8 email: 'demo@example.com',

9 name: 'Demo User',

10 avatar: 'https://i.pravatar.cc/150?img=1'

11};

13const MOCK_TOKEN = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwiZW1haWwiOiJkZW1vQGV4YW1wbGUuY29tIiwiaWF0IjoxNjE2MjM5MDIyLCJleHAiOjk5OTk5OTk5OTl9.mock';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bin/templates/default/src/services/auth.tsView on unpkg · L13

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/src/services/auth.ts

bin/templates/default/src/services/auth.tsView on unpkg · L13

15export async function login(credentials: LoginCredentials): Promise<LoginResponse> {

16 // Simulate API call

17 await new Promise(resolve => setTimeout(resolve, 500));

19 // Mock validation

20 if (credentials.email === 'demo@example.com' && credentials.password === 'demo') {

21 setToken(MOCK_TOKEN);

22 setUser(MOCK_USER);

24 return {

25 token: MOCK_TOKEN,

26 user: MOCK_USER

27 };

28 }

30 throw new Error('Invalid credentials');

31}

33export async function logout(): Promise<void> {

dist/components/pdf-viewer/pdf.worker.min.mjsView file

20* JavaScript code in this page L21: */var e={d:(t,i)=>{for(var a in i)e.o(i,a)&&!e.o(t,a)&&Object.defineProperty(t,a,{enumerable:!0,get:i[a]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t)},__webpack_exports__ ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/components/pdf-viewer/pdf.worker.min.mjsView on unpkg · L20

dist/components/qr-reader/zxing_reader.wasmView file

•path = dist/components/qr-reader/zxing_reader.wasm kind = wasm_module sizeBytes = 944424 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/components/qr-reader/zxing_reader.wasmView on unpkg

bin/templates/default/tests/services/auth.test.tsView file

Lines 38-78typescript

39 await expect(login(credentials)).rejects.toThrow('Invalid credentials');

40 });

41 });

43 describe('logout', () => {

44 it('should clear token on logout', async

bin/templates/default/tests/services/jwt.test.tsView file

Lines 1-35typescript

1import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';

2import { decodeJWT, isTokenExpired, getTokenExpiration } from '../../src/services/jwt';

4describe('JWT Service', () => {

5 describe('decodeJWT', () => {

6 // decodeJWT logs a console.error when a token can't be parsed; several

bin/templates/react/tests/services/auth.test.tsView file

Lines 38-78typescript

39 await expect(login(credentials)).rejects.toThrow('Invalid credentials');

40 });

41 });

43 describe('logout', () => {

44 it('should clear token on logout', async

bin/templates/react/tests/services/jwt.test.tsView file

Lines 1-28typescript

1import { describe, it, expect, vi } from 'vitest';

2import { decodeJWT, isTokenExpired, getTokenExpiration } from '../../src/services/jwt';

4describe('JWT Service', () => {

5 describe('decodeJWT', () => {

6 it(

bin/templates/react/src/services/auth.tsView file

Lines 1-33typescript

1import type { LoginCredentials, LoginResponse, User } from '../types/auth';

2import { setToken, setUser, clearToken, getToken } from './storage';

3import { isTokenExpired } from './jwt';

5// Mock API - replace with real API calls

6const MOCK_USER: User

Source & flagged code

9 flagged · loading source

bin/templates/default/src/services/auth.tsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const MO...ck';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bin/templates/default/src/services/auth.tsView on unpkg · L13

13patternName = supabase_service_key severity = critical line = 13 matchedText = const MO...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/src/services/auth.ts

bin/templates/default/src/services/auth.tsView on unpkg · L13

dist/components/pdf-viewer/pdf.worker.min.mjsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/components/pdf-viewer/pdf.worker.min.mjsView on unpkg · L20

dist/components/qr-reader/zxing_reader.wasmView file

•path = dist/components/qr-reader/zxing_reader.wasm kind = wasm_module sizeBytes = 944424 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/components/qr-reader/zxing_reader.wasmView on unpkg

bin/templates/default/tests/services/auth.test.tsView file

58patternName = supabase_service_key severity = critical line = 58 matchedText = const to...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/tests/services/auth.test.ts

bin/templates/default/tests/services/auth.test.tsView on unpkg · L58

bin/templates/default/tests/services/jwt.test.tsView file

15patternName = supabase_service_key severity = critical line = 15 matchedText = const to...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/tests/services/jwt.test.ts

bin/templates/default/tests/services/jwt.test.tsView on unpkg · L15

bin/templates/react/tests/services/auth.test.tsView file

58patternName = supabase_service_key severity = critical line = 58 matchedText = const to...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/react/tests/services/auth.test.ts

bin/templates/react/tests/services/auth.test.tsView on unpkg · L58

bin/templates/react/tests/services/jwt.test.tsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = const to...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/react/tests/services/jwt.test.ts

bin/templates/react/tests/services/jwt.test.tsView on unpkg · L8

bin/templates/react/src/services/auth.tsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const MO...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/react/src/services/auth.ts

bin/templates/react/src/services/auth.tsView on unpkg · L13

Findings

7 Critical5 Medium7 Low

CriticalCritical Secretbin/templates/default/src/services/auth.ts

CriticalSecret Patternbin/templates/default/tests/services/auth.test.ts

CriticalSecret Patternbin/templates/default/tests/services/jwt.test.ts

CriticalSecret Patternbin/templates/default/src/services/auth.ts

CriticalSecret Patternbin/templates/react/tests/services/auth.test.ts

CriticalSecret Patternbin/templates/react/tests/services/jwt.test.ts

CriticalSecret Patternbin/templates/react/src/services/auth.ts

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/components/qr-reader/zxing_reader.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/components/pdf-viewer/pdf.worker.min.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Authorhedzer

Maintainershedzer

Version6.1.0

PublishedJul 9, 2026

LicenseMIT

Dependencies5

Integrityverified

Package size10.2 MB

Files2,679

Keywordsweb componentsweb-componentswebcomponentsweb-componentcustom elementscustom-elementscustom-elementshadow dom

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.cjsmodule → dist/index.esm.jstypes → dist/index.d.tsexports mapbin → snice, snice-mcp

Runtimenode >=18.0.0

Artifact50.4 MB · 2,679 files1 signature(s)

Install lifecycleNo install hooks · other: build, build-storybook, build:cdn, build:core +8

Behavioral surface

ChildProcessEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStringsManifest: clean

Source & flagged code

9 flagged

bin/templates/default/src/services/auth.tsView file

Lines 1-33typescript

1import type { LoginCredentials, LoginResponse, User } from '../types/auth';

2import { setToken, setUser, clearToken, getToken } from './storage';

3import { isTokenExpired } from './jwt';

5// Mock API - replace with real API calls

6const MOCK_USER: User = {

7 id: '1',

8 email: 'demo@example.com',

9 name: 'Demo User',

10 avatar: 'https://i.pravatar.cc/150?img=1'

11};

13const MOCK_TOKEN = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwiZW1haWwiOiJkZW1vQGV4YW1wbGUuY29tIiwiaWF0IjoxNjE2MjM5MDIyLCJleHAiOjk5OTk5OTk5OTl9.mock';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bin/templates/default/src/services/auth.tsView on unpkg · L13

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/src/services/auth.ts

bin/templates/default/src/services/auth.tsView on unpkg · L13

15export async function login(credentials: LoginCredentials): Promise<LoginResponse> {

16 // Simulate API call

17 await new Promise(resolve => setTimeout(resolve, 500));

19 // Mock validation

20 if (credentials.email === 'demo@example.com' && credentials.password === 'demo') {

21 setToken(MOCK_TOKEN);

22 setUser(MOCK_USER);

24 return {

25 token: MOCK_TOKEN,

26 user: MOCK_USER

27 };

28 }

30 throw new Error('Invalid credentials');

31}

33export async function logout(): Promise<void> {

dist/components/pdf-viewer/pdf.worker.min.mjsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/components/pdf-viewer/pdf.worker.min.mjsView on unpkg · L20

dist/components/qr-reader/zxing_reader.wasmView file

•path = dist/components/qr-reader/zxing_reader.wasm kind = wasm_module sizeBytes = 944424 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/components/qr-reader/zxing_reader.wasmView on unpkg

bin/templates/default/tests/services/auth.test.tsView file

Lines 38-78typescript

39 await expect(login(credentials)).rejects.toThrow('Invalid credentials');

40 });

41 });

43 describe('logout', () => {

44 it('should clear token on logout', async

bin/templates/default/tests/services/jwt.test.tsView file

Lines 1-35typescript

1import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';

2import { decodeJWT, isTokenExpired, getTokenExpiration } from '../../src/services/jwt';

4describe('JWT Service', () => {

5 describe('decodeJWT', () => {

6 // decodeJWT logs a console.error when a token can't be parsed; several

bin/templates/react/tests/services/auth.test.tsView file

Lines 38-78typescript

39 await expect(login(credentials)).rejects.toThrow('Invalid credentials');

40 });

41 });

43 describe('logout', () => {

44 it('should clear token on logout', async

bin/templates/react/tests/services/jwt.test.tsView file

Lines 1-28typescript

1import { describe, it, expect, vi } from 'vitest';

2import { decodeJWT, isTokenExpired, getTokenExpiration } from '../../src/services/jwt';

4describe('JWT Service', () => {

5 describe('decodeJWT', () => {

6 it(

bin/templates/react/src/services/auth.tsView file

Lines 1-33typescript

1import type { LoginCredentials, LoginResponse, User } from '../types/auth';

2import { setToken, setUser, clearToken, getToken } from './storage';

3import { isTokenExpired } from './jwt';

5// Mock API - replace with real API calls

6const MOCK_USER: User