registry / torch_glare_test / 2.4.0

torch_glare_test@2.4.0

A copy-in React component library (TypeScript + Radix UI + Tailwind CSS). Its CLI copies component source directly into your project — you own the code.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 146 file(s), 789 KB of source, external domains: www.w3.org

Source & flagged code

5 flagged

dist/src/shared/installDependencies.jsView file

Lines 1-21javascript

1import { execSync } from "child_process";

2import { getCurrentInstalledDependencies } from "./getCurrentInstalledDependencies.js";

High

Child Process

Package source references child process execution.

dist/src/shared/installDependencies.jsView on unpkg · L1

3import { detectPackageManager } from "./detectPackageManager.js";

4import { getDependenciesAndInstallNestedComponents } from "./getDependenciesAndInstallNestedComponents.js";

5import { getInstallCommand } from "./getInstallCommand.js";

6/**

7 * Install dependencies for a component.

8 * @param {string} componentPath - Path to the component file.

9 */

10export function installDependencies(componentPath) {

11 // get current installed dependencies on your package.json

12 const { depsNames } = getCurrentInstalledDependencies();

13 // get dependencies used in the component and it's nested components.

14 // also copy component to the target directory with it's nested components.

15 const dependenciesToInstall = getDependenciesAndInstallNestedComponents(componentPath, depsNames);

16 // if there are dependencies to install, install them

17 if (dependenciesToInstall.size > 0) {

18 // detect package manager

19 const packageManager = detectPackageManager();

20 // get full install command

21 const installCommand = getInstallCommand(packageManager, dependenciesToInstall);

dist/src/shared/tailwindInit.jsView file

Lines 12-52javascript

12 "glare-torch-mode",

13 ];

14 installDependencies(dependencies);

15}

16/**

17 * Installs dependencies using the detected package manager.

18 * @param {string[]} dependencies - List of dependencies to install.

19 */

20function installDependencies

docs/components/label-field.mdView file

Lines 212-254markdown

212 email: '',

213 password: '',

214 })

215

216 const [errors, setErrors] = useState<Record<string, string>>({})

217

218 const validate = () => {

219 const newErrors: Record<string, string> = {}

220

221 if (!formData.name) {

222 newErrors.name = 'Name is required'

223 }

224

225

docs/components/inner-label-field.mdView file

Lines 166-206markdown

166

167function LoginForm() {

168 const [credentials, setCredentials] = useState({

169 email: '',

170 password: '',

171 })

172 const [errors, setErrors] = useState<Record<string, string>>({})

173

174 const handleSubmit = (e: React.FormEvent) => {

175 e.preventDefault()

176

177 const newErrors: Record<string, string> = {}

178

Source & flagged code

5 flagged · loading source

dist/src/shared/installDependencies.jsView file

1import { execSync } from "child_process"; L2: import { getCurrentInstalledDependencies } from "./getCurrentInstalledDependencies.js";

High

Child Process

Package source references child process execution.

dist/src/shared/installDependencies.jsView on unpkg · L1

dist/src/shared/tailwindInit.jsView file

32case "pnpm": L33: installCommand = `pnpm add ${latestDeps} --prefer-offline`; L34: break; ... L46: console.log(`Running: ${installCommand}`); L47: execSync(installCommand, { stdio: "inherit" }); L48: console.log("✅ Dependencies installed successfully.");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/shared/tailwindInit.jsView on unpkg · L32

docs/components/label-field.mdView file

232patternName = generic_password severity = medium line = 232 matchedText = newError...red'

Medium

Secret Pattern

Hardcoded password in docs/components/label-field.md

docs/components/label-field.mdView on unpkg · L232

234patternName = generic_password severity = medium line = 234 matchedText = newError...ers'

Medium

Secret Pattern

Hardcoded password in docs/components/label-field.md

docs/components/label-field.mdView on unpkg · L234

docs/components/inner-label-field.mdView file

186patternName = generic_password severity = medium line = 186 matchedText = newError...red'

Medium

Secret Pattern

Hardcoded password in docs/components/inner-label-field.md

docs/components/inner-label-field.mdView on unpkg · L186

Findings

3 High4 Medium5 Low

HighChild Processdist/src/shared/installDependencies.js

HighShell

HighRuntime Package Installdist/src/shared/tailwindInit.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/components/label-field.md

MediumSecret Patterndocs/components/inner-label-field.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/src/shared/installDependencies.jsView file

Lines 1-21javascript

1import { execSync } from "child_process";

2import { getCurrentInstalledDependencies } from "./getCurrentInstalledDependencies.js";

High

Child Process

Package source references child process execution.

dist/src/shared/installDependencies.jsView on unpkg · L1

3import { detectPackageManager } from "./detectPackageManager.js";

4import { getDependenciesAndInstallNestedComponents } from "./getDependenciesAndInstallNestedComponents.js";

5import { getInstallCommand } from "./getInstallCommand.js";

6/**

7 * Install dependencies for a component.

8 * @param {string} componentPath - Path to the component file.

9 */

10export function installDependencies(componentPath) {

11 // get current installed dependencies on your package.json

12 const { depsNames } = getCurrentInstalledDependencies();

13 // get dependencies used in the component and it's nested components.

14 // also copy component to the target directory with it's nested components.

15 const dependenciesToInstall = getDependenciesAndInstallNestedComponents(componentPath, depsNames);

16 // if there are dependencies to install, install them

17 if (dependenciesToInstall.size > 0) {

18 // detect package manager

19 const packageManager = detectPackageManager();

20 // get full install command

21 const installCommand = getInstallCommand(packageManager, dependenciesToInstall);

dist/src/shared/tailwindInit.jsView file

Lines 12-52javascript

12 "glare-torch-mode",

13 ];

14 installDependencies(dependencies);

15}

16/**

17 * Installs dependencies using the detected package manager.

18 * @param {string[]} dependencies - List of dependencies to install.

19 */

20function installDependencies

docs/components/label-field.mdView file

Lines 212-254markdown

212 email: '',

213 password: '',

214 })

215

216 const [errors, setErrors] = useState<Record<string, string>>({})

217

218 const validate = () => {

219 const newErrors: Record<string, string> = {}

220

221 if (!formData.name) {

222 newErrors.name = 'Name is required'

223 }

224

225

docs/components/inner-label-field.mdView file

Lines 166-206markdown

166

167function LoginForm() {

168 const [credentials, setCredentials] = useState({

169 email: '',

170 password: '',

171 })

172 const [errors, setErrors] = useState<Record<string, string>>({})

173

174 const handleSubmit = (e: React.FormEvent) => {

175 e.preventDefault()

176

177 const newErrors: Record<string, string> = {}

178