registry / ui-soxo-bootstrap-core / 2.6.41

ui-soxo-bootstrap-core@2.6.41

All the Core Components for you to start

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. Risky primitives are exposed as application features and require consumer UI/runtime invocation.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer imports/uses specific React components or utility functions at runtime; registry install does not activate a malicious hook.

Impact

No evidence of unconsented credential/file harvesting, persistence, destructive behavior, or covert exfiltration.

Mechanism

React component library with dynamic scripts, configured API calls, and user-invoked AI/TTS/browser integrations

Rationale

The package contains questionable application-level patterns such as eval-based form scripts and remote component loading, but inspection ties them to explicit runtime features rather than install-time or hidden malicious behavior. No concrete unconsented exfiltration, persistence, destructive action, dependency-confusion behavior, or AI-agent control-surface mutation was found.

Evidence

package.jsonindex.jscore/lib/utils/script.utils.jscore/utils/script.utils.jscore/components/component-loader/component-loader.jscore/modules/steps/chat-assistant.jscore/modules/steps/openai-realtime.jscore/modules/steps/steps.jscore/lib/utils/http/http.utils.jscore/lib/utils/http/auth.helper.jscore/lib/elements/complex/google-map/google-map.js

ui-soxo-bootstrap-core@2.6.41

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code