registry / snice / 6.1.0

snice@6.1.0

A decorator-driven web component library with differential rendering, routing, controllers, and 130+ ready-made UI components. Use as much or as little as you want. Zero dependencies, works anywhere.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 861 file(s), 19.7 MB of source, external domains: api.example.com, example.com, fastly.jsdelivr.net, i.pravatar.cc, maps.apple.com, ns.adobe.com, tile.openstreetmap.org, www.google.com, www.itunes.com, www.openstreetmap.org, www.w3.org, www.xfa.org

Source & flagged code

10 flagged

bin/templates/default/src/services/auth.tsView file

Lines 1-33typescript

1import type { LoginCredentials, LoginResponse, User } from '../types/auth';

2import { setToken, setUser, clearToken, getToken } from './storage';

3import { isTokenExpired } from './jwt';

5// Mock API - replace with real API calls

6const

Source & flagged code

10 flagged · loading source

bin/templates/default/src/services/auth.tsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const MO...ck';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bin/templates/default/src/services/auth.tsView on unpkg · L13

13patternName = supabase_service_key severity = critical line = 13 matchedText = const MO...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/src/services/auth.ts

bin/templates/default/src/services/auth.tsView on unpkg · L13

dist/components/pdf-viewer/pdf.worker.min.mjsView file

20* JavaScript code in this page L21: */var e={d:(t,i)=>{for(var a in i)e.o(i,a)&&!e.o(t,a)&&Object.defineProperty(t,a,{enumerable:!0,get:i[a]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t)},__webpack_exports__ ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/components/pdf-viewer/pdf.worker.min.mjsView on unpkg · L20

dist/components/qr-reader/zxing_reader.wasmView file

•path = dist/components/qr-reader/zxing_reader.wasm kind = wasm_module sizeBytes = 944424 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/components/qr-reader/zxing_reader.wasmView on unpkg

bin/snice.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = snice@6.0.0 matchedIdentity = npm:c25pY2U:6.0.0 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/snice.jsView on unpkg

bin/templates/default/tests/services/auth.test.tsView file

58patternName = supabase_service_key severity = critical line = 58 matchedText = const to...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/tests/services/auth.test.ts

bin/templates/default/tests/services/auth.test.tsView on unpkg · L58

bin/templates/default/tests/services/jwt.test.tsView file

15patternName = supabase_service_key severity = critical line = 15 matchedText = const to...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/tests/services/jwt.test.ts

bin/templates/default/tests/services/jwt.test.tsView on unpkg · L15

bin/templates/react/tests/services/auth.test.tsView file

58patternName = supabase_service_key severity = critical line = 58 matchedText = const to...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/react/tests/services/auth.test.ts

bin/templates/react/tests/services/auth.test.tsView on unpkg · L58

bin/templates/react/tests/services/jwt.test.tsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = const to...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/react/tests/services/jwt.test.ts

bin/templates/react/tests/services/jwt.test.tsView on unpkg · L8

bin/templates/react/src/services/auth.tsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const MO...ck';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/react/src/services/auth.ts

bin/templates/react/src/services/auth.tsView on unpkg · L13

Findings

7 Critical1 High5 Medium7 Low

CriticalCritical Secretbin/templates/default/src/services/auth.ts

CriticalSecret Patternbin/templates/default/tests/services/auth.test.ts

CriticalSecret Patternbin/templates/default/tests/services/jwt.test.ts

CriticalSecret Patternbin/templates/default/src/services/auth.ts

CriticalSecret Patternbin/templates/react/tests/services/auth.test.ts

CriticalSecret Patternbin/templates/react/tests/services/jwt.test.ts

CriticalSecret Patternbin/templates/react/src/services/auth.ts

HighPrevious Version Dangerous Deltabin/snice.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/components/qr-reader/zxing_reader.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/components/pdf-viewer/pdf.worker.min.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

93%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Authorhedzer

Maintainershedzer

Version6.1.0

PublishedJul 14, 2026

LicenseMIT

Dependencies5

Integrityverified

Package size11.7 MB

Files2,708

Keywordsweb componentsweb-componentswebcomponentsweb-componentcustom elementscustom-elementscustom-elementshadow dom

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.cjsmodule → dist/index.esm.jstypes → dist/index.d.tsexports mapbin → snice, snice-mcp

Runtimenode >=18.0.0

Artifact59.5 MB · 2,708 files1 signature(s)

Install lifecycleNo install hooks · other: build, build-storybook, build:cdn, build:core +8

Behavioral surface

ChildProcessEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStringsManifest: clean

bin/templates/default/tests/services/auth.test.tsView file

Lines 38-78typescript

39 await expect(login(credentials)).rejects.toThrow('Invalid credentials');

40 });

41 });

43 describe('logout', () => {

44 it('should clear token on logout', async () => {

45 storage.setToken('test-token');

46 storage.setUser({ id: '1', name: 'Test' });

48 await logout();

50 expect(storage.getToken()).toBeNull();

51 expect(storage.getUser()).toBeNull();

52 });

53 });

55 describe('isAuthenticated', () => {

56 it('should return true when valid token exists', () => {

57 // Non-expired token

58 const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwiZW1haWwiOiJkZW1vQGV4YW1wbGUuY29tIiwiaWF0IjoxNjE2MjM5MDIyLCJleHAiOjk5OTk5OTk5OTl9.mock';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/tests/services/auth.test.ts

bin/templates/default/tests/services/auth.test.tsView on unpkg · L58

59 storage.setToken(token);

61 expect(isAuthenticated()).toBe(true);

62 });

64 it('should return false when no token exists', () => {

65 expect(isAuthenticated()).toBe(false);

66 });

68 it('should return false when token is expired', () => {

69 // Expired token

70 const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwiZXhwIjoxNjAwMDAwMDAwfQ.mock';

71 storage.setToken(token);

73 expect(isAuthenticated()).toBe(false);

74 });

75 });

77 describe('refreshToken', () => {

78 it('should return new token', async () => {

bin/templates/default/tests/services/jwt.test.tsView file

Lines 1-35typescript

1import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';

2import { decodeJWT, isTokenExpired, getTokenExpiration } from '../../src/services/jwt';

4describe('JWT Service', () => {

5 describe('decodeJWT', () => {

6 // decodeJWT logs a console.error when a token can't be parsed; several

7 // cases below feed intentionally-invalid tokens. Silence that expected

8 // log for this block — the assertions verify the null return, not the log.

9 let errorSpy: ReturnType<typeof vi.spyOn>;

10 beforeEach(() => { errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {}); });

11 afterEach(() => { errorSpy.mockRestore(); });

13 it('should decode a valid JWT', () => {

14 // Valid JWT: {"sub":"123","name":"Test","exp":9999999999}

15 const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJuYW1lIjoiVGVzdCIsImV4cCI6OTk5OTk5OTk5OX0.mock';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/default/tests/services/jwt.test.ts

bin/templates/default/tests/services/jwt.test.tsView on unpkg · L15

16 const payload = decodeJWT(token);

18 expect(payload).toBeTruthy();

19 expect(payload?.sub).toBe('123');

20 expect(payload?.name).toBe('Test');

21 expect(payload?.exp).toBe(9999999999);

22 });

24 it('should return null for invalid JWT format', () => {

25 const payload = decodeJWT('invalid-token');

26 expect(payload).toBeNull();

27 });

29 it('should return null for malformed JWT', () => {

30 const payload = decodeJWT('part1.part2');

31 expect(payload).toBeNull();

32 });

34 it('should return null for JWT with invalid base64', () => {

35 const payload = decodeJWT('header.!!!invalid!!!.signature');

bin/templates/react/tests/services/auth.test.tsView file

Lines 38-78typescript

39 await expect(login(credentials)).rejects.toThrow('Invalid credentials');

40 });

41 });

43 describe('logout', () => {

44 it('should clear token on logout', async () => {

45 storage.setToken('test-token');

46 storage.setUser({ id: '1', name: 'Test' });

48 await logout();

50 expect(storage.getToken()).toBeNull();

51 expect(storage.getUser()).toBeNull();

52 });

53 });

55 describe('isAuthenticated', () => {

56 it('should return true when valid token exists', () => {

57 // Non-expired token

58 const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwiZW1haWwiOiJkZW1vQGV4YW1wbGUuY29tIiwiaWF0IjoxNjE2MjM5MDIyLCJleHAiOjk5OTk5OTk5OTl9.mock';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/templates/react/tests/services/auth.test.ts

bin/templates/react/tests/services/auth.test.tsView on unpkg · L58

59 storage.setToken(token);

61 expect(isAuthenticated()).toBe(true);

62 });

64 it('should return false when no token exists', () => {

65 expect(isAuthenticated()).toBe(false);

66 });

68 it('should return false when token is expired', () => {

69 // Expired token

70 const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwiZXhwIjoxNjAwMDAwMDAwfQ.mock';

71 storage.setToken(token);

73 expect(isAuthenticated()).toBe(false);

74 });

75 });

77 describe('refreshToken', () => {

78 it('should return new token', async () => {