registry / verben-workflow-ui / 0.5.80

verben-workflow-ui@0.5.80

This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 18.2.0.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The runtime HTTP helper makes normal application-initiated API requests to a consumer-configured base URL.

Static reason

One or more suspicious static signals were detected.

Trigger

A consuming Angular application invokes `HttpWebRequestService` methods.

Impact

No install-time execution, persistence, data harvesting, remote payload execution, or destructive action was identified.

Mechanism

Angular HttpClient requests with configured API base URL and authorization header.

Rationale

The scanner signal is explained by an expired hard-coded JWT fallback in a conventional Angular HTTP service. This is a security-quality concern, but direct source inspection found no concrete malicious behavior.

Evidence

package.jsonfesm2022/verben-workflow-ui.mjsfesm2022/verben-workflow-ui-src-lib-services.mjsREADME.md

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with medium false-positive risk.

Evidence for block

`fesm2022/verben-workflow-ui-src-lib-services.mjs` contains a hard-coded JWT fallback Authorization value.
The same service sends requests through Angular HttpClient to a host-provided `WorkFlowAPI` base URL.

Evidence against

`package.json` has no lifecycle scripts or `bin` entrypoint.
Package exports Angular UI modules only and declares `sideEffects: false`.
No child-process, eval/vm, dynamic loading, filesystem-write, environment-harvesting, or AI-agent configuration primitives were found.
No non-template network endpoint is embedded; request destinations are supplied by the consuming application's environment.
The apparent JWT fallback has an embedded expiry timestamp in November 2025, before this review date.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 319 file(s), 4.96 MB of source, external domains: example.com, www.w3.org

Source & flagged code

3 flagged

fesm2022/verben-workflow-ui-src-lib-services.mjsView file

Lines 32-72javascript

33class HttpWebRequestService {

34 http;

35 envSvc;

36 notificationService;

37 isProd;

38 constructor(http, envSvc, notificationService) {

39 this.http = http;

40 this.envSvc = envSvc;

41 this.notificationService = notificationService;

42 this.isProd = this.envSvc.environment.production;

43 }

44 buildHeaders(ovverideToken = null) {

45 const customToken = this.envSvc.environment.Token;

46 return customToken ? {

47 'Content-Type': 'application/json',

48 'X-Custom-Auth': customToken,

49 Authorization: customToken,

50 } : {

51 'Content-Type': 'application/json',

52 Authorization: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJNYWlsQWRkcmVzcyI6InZlcmJlbmFAZ21haWwuY29tIiwiQXBwbGljYXRpb24iOiIiLCJOYW1lIjoiVmVyYmVuYSBMb2dpYyBMaW1pdGVkIiwiUm9sZUlEIjoiUk9MLVpYQVhYVCIsIlRlbmFudElkIjoiUERMVEM2IiwiU2VydmljZU5hbWUiOiJXaGl0ZTM2MCIsIkNvbXBhbnkiOiJDT00tNkxJNjNIIiwibmJmIjoxNzYyOTM2NDEzLCJleHAiOjE3NjMxNTI0MTMsImlhdCI6MTc2MjkzNjQxM30.eRVY1O1tch0-2ysXfhwW8G-kOlRAg-oOd-Oo8UYUx9g',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

fesm2022/verben-workflow-ui-src-lib-services.mjsView on unpkg · L52

Critical

Secret Pattern

Supabase service role key (JWT) in fesm2022/verben-workflow-ui-src-lib-services.mjs

fesm2022/verben-workflow-ui-src-lib-services.mjsView on unpkg · L52

53 };

54 }

55 buildUrl(url, baseUrl) {

56 return `${baseUrl}/${url}`;

57 }

58 handleError(err) {

59 const msg = err?.ErrorMsg ||

60 err?.errors?.values?.toString() ||

61 `Error occurred`;

62 this.notificationService.error(msg, { timeout: 10000 });

63 h: return new ErrorResponse(msg);

64 }

65 request(method, url, body, overrideToken, baseUrl = this.envSvc.environment.WorkFlowAPI) {

66 const options = {

67 headers: this.buildHeaders(overrideToken),

68 };

69 const requestUrl = this.buildUrl(url, baseUrl);

70 switch (method) {

71 case 'GET':

72 return new Promise((resolve) => this.http.get(requestUrl, options).subscribe({

esm2022/src/lib/services/http-web-request.service.mjsView file

Lines 6-46javascript

6import * as i3 from "verben-ng-ui";

7export class HttpWebRequestService {

8 http;

9 envSvc;

10 notificationService;

11 isProd;

Source & flagged code

3 flagged · loading source

fesm2022/verben-workflow-ui-src-lib-services.mjsView file

52patternName = supabase_service_key severity = critical line = 52 matchedText = Authoriz...9g',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

fesm2022/verben-workflow-ui-src-lib-services.mjsView on unpkg · L52

52patternName = supabase_service_key severity = critical line = 52 matchedText = Authoriz...9g',

Critical

Secret Pattern

Supabase service role key (JWT) in fesm2022/verben-workflow-ui-src-lib-services.mjs

fesm2022/verben-workflow-ui-src-lib-services.mjsView on unpkg · L52

esm2022/src/lib/services/http-web-request.service.mjsView file

26patternName = supabase_service_key severity = critical line = 26 matchedText = Authoriz...9g',

Critical

Secret Pattern

Supabase service role key (JWT) in esm2022/src/lib/services/http-web-request.service.mjs

esm2022/src/lib/services/http-web-request.service.mjsView on unpkg · L26

Findings

3 Critical3 Low

CriticalCritical Secretfesm2022/verben-workflow-ui-src-lib-services.mjs

CriticalSecret Patternfesm2022/verben-workflow-ui-src-lib-services.mjs

CriticalSecret Patternesm2022/src/lib/services/http-web-request.service.mjs

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

fesm2022/verben-workflow-ui-src-lib-services.mjsView file

Lines 32-72javascript

33class HttpWebRequestService {

34 http;

35 envSvc;

36 notificationService;

37 isProd;

38 constructor(http, envSvc, notificationService) {

39 this.http = http;

40 this.envSvc = envSvc;

41 this.notificationService = notificationService;

42 this.isProd = this.envSvc.environment.production;

43 }

44 buildHeaders(ovverideToken = null) {

45 const customToken = this.envSvc.environment.Token;

46 return customToken ? {

47 'Content-Type': 'application/json',

48 'X-Custom-Auth': customToken,

49 Authorization: customToken,

50 } : {

51 'Content-Type': 'application/json',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

fesm2022/verben-workflow-ui-src-lib-services.mjsView on unpkg · L52

Critical

Secret Pattern

Supabase service role key (JWT) in fesm2022/verben-workflow-ui-src-lib-services.mjs

fesm2022/verben-workflow-ui-src-lib-services.mjsView on unpkg · L52

53 };

54 }

55 buildUrl(url, baseUrl) {

56 return `${baseUrl}/${url}`;

57 }

58 handleError(err) {

59 const msg = err?.ErrorMsg ||

60 err?.errors?.values?.toString() ||

61 `Error occurred`;

62 this.notificationService.error(msg, { timeout: 10000 });

63 h: return new ErrorResponse(msg);

64 }

65 request(method, url, body, overrideToken, baseUrl = this.envSvc.environment.WorkFlowAPI) {

66 const options = {

67 headers: this.buildHeaders(overrideToken),

68 };

69 const requestUrl = this.buildUrl(url, baseUrl);

70 switch (method) {

71 case 'GET':

72 return new Promise((resolve) => this.http.get(requestUrl, options).subscribe({

esm2022/src/lib/services/http-web-request.service.mjsView file

Lines 6-46javascript

6import * as i3 from "verben-ng-ui";

7export class HttpWebRequestService {

8 http;

9 envSvc;

10 notificationService;

11 isProd;