registry / xertica-ui / 2.9.7

xertica-ui@2.9.7

Xertica UI — Enterprise-grade React design system with Tailwind CSS v4, Radix UI, and AI-first documentation.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `xertica-ui init`, selects the full-system scaffold, and completes prompts.

Impact

A coding agent operating in that generated project may follow the package-authored development guidance.

Mechanism

Explicit CLI scaffold copies `CLAUDE.md` into the target project.

Rationale

This is not malicious, but it has a confirmed explicit-user-command AI-agent control-surface write that warrants a warning under the supplied policy. The networked Gemini and Google Maps features are package-aligned and user/configuration driven.

Evidence

package.jsonbin/cli.tstemplates/CLAUDE.mdutils/gemini.tscontexts/ApiKeyContext.tsx<targetDir>/CLAUDE.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`bin/cli.ts` registers an explicit `init` scaffold command.
The full-system `init` copy list includes `CLAUDE.md`.
`templates/CLAUDE.md` supplies AI-agent project instructions.
CLI writes only after user invokes `init` and completes prompts.

Evidence against

`package.json` has no preinstall/install/postinstall hook; `prepublishOnly` is publisher-only.
`templates/CLAUDE.md` contains design and coding guidance, not exfiltration or command execution.
Gemini calls in `utils/gemini.ts` require a caller-provided key and chat action.
Embedded key-like strings in `contexts/ApiKeyContext.tsx` are a local-storage cleanup denylist, not outbound credentials.
No source evidence of credential harvesting, stealth persistence, remote payload execution, or destructive actions.

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 1,005 file(s), 20.1 MB of source, external domains: aistudio.google.com, cdnjs.cloudflare.com, example.com, github.com, google.com, illustrations.popsy.co, images.unsplash.com, maps.googleapis.com, peach.blender.org, www.soundhelix.com, www.w3.org, www.w3schools.com, xertica.com

Source & flagged code

16 flagged

contexts/ApiKeyContext.tsxView file

Lines 26-66tsx

26 if (typeof window === 'undefined') return;

27 window.localStorage?.removeItem(key);

28};

30interface ApiKeyProviderProps {

31 children: ReactNode;

32 initialApiKey?: string;

33 initialGeminiApiKey?: string;

34 initialGoogleMapsApiKey?: string;

35}

37export function ApiKeyProvider({

38 children,

39 initialApiKey,

40 initialGeminiApiKey,

41 initialGoogleMapsApiKey,

42}: ApiKeyProviderProps) {

43 // Lista de chaves conhecidas como vazadas (para limpeza automática)

44 const LEAKED_KEYS = [

45 'AIzaSyCMsAMytBeOK0Qd7RKFyA5IW9eWt2WTJg',

46 'AIzaSyAiYWEIEmx212Up9zfM8kqyMXB4jLs8gq0',

High

High Secret

Package contains a high-severity secret pattern.

contexts/ApiKeyContext.tsxView on unpkg · L46

High

Secret Pattern

Google API key in contexts/ApiKeyContext.tsx

contexts/ApiKeyContext.tsxView on unpkg · L46

47 ];

49 const [apiKey, setApiKeyState] = useState<string>(() => {

50 if (initialApiKey) return initialApiKey;

51 const saved = readStorage('xertica-api-key');

52 return saved || '';

53 });

55 const [geminiApiKey, setGeminiApiKeyState] = useState<string>(() => {

56 if (initialGeminiApiKey) return initialGeminiApiKey;

57 const saved = readStorage('xertica-gemini-api-key');

59 // Se a chave salva estiver na lista de vazadas, removê-la

60 if (saved && LEAKED_KEYS.includes(saved)) {

61 removeStorage('xertica-gemini-api-key');

62 return '';

63 }

65 return saved || '';

66 });

dist/BrandColorsContext-BNKLUVcU.jsView file

Lines 2-42javascript

2import React__default, { createContext, useState, useEffect, useContext } from 'react';

4const ApiKeyContext = createContext(void 0);

5const readStorage = (key) => typeof window !== "undefined"

dist/BrandColorsContext-B25Bpr3b.cjsView file

Lines 4-44javascript

4const React = require('react');

6const ApiKeyContext = React.createContext(void 0);

7const readStorage = (key) => typeof window !==

dist/BrandColorsContext-DjpC9wR_.cjsView file

Lines 4-44javascript

4const React = require('react');

6const ApiKeyContext = React.createContext(void 0);

7const readStorage = (key) => typeof window !==

dist/BrandColorsContext-BCieATdW.jsView file

Lines 2-42javascript

2import React__default, { createContext, useState, useEffect, useContext } from 'react';

4const ApiKeyContext = createContext(void 0);

5const readStorage = (key) => typeof window !== "undefined"

dist/BrandColorsContext-DNZGHItQ.cjsView file

Lines 4-44javascript

4const React = require('react');

6const ApiKeyContext = React.createContext(void 0);

7const readStorage = (key) => typeof window !==

dist/BrandColorsContext-DP0DXAXS.jsView file

Lines 2-42javascript

2import React__default, { createContext, useState, useEffect, useContext } from 'react';

4const ApiKeyContext = createContext(void 0);

5const readStorage = (key) => typeof window !== "undefined"

dist/BrandColorsContext-z0O2LlZz.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-z0O2LlZz.js

dist/BrandColorsContext-z0O2LlZz.jsView on unpkg · L22

dist/BrandColorsContext-B4_81eas.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-B4_81eas.cjs

dist/BrandColorsContext-B4_81eas.cjsView on unpkg · L24

dist/BrandColorsContext-V3tOc-Zw.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-V3tOc-Zw.js

dist/BrandColorsContext-V3tOc-Zw.jsView on unpkg · L22

dist/BrandColorsContext-DbK5LnQ_.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-DbK5LnQ_.js

dist/BrandColorsContext-DbK5LnQ_.jsView on unpkg · L22

dist/BrandColorsContext-MpXFhte7.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-MpXFhte7.cjs

dist/BrandColorsContext-MpXFhte7.cjsView on unpkg · L24

dist/BrandColorsContext-Ug_TZ8yn.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-Ug_TZ8yn.cjs

dist/BrandColorsContext-Ug_TZ8yn.cjsView on unpkg · L24

docs/components/pages.mdView file

124patternName = generic_password severity = medium line = 124 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in docs/components/pages.md

docs/components/pages.mdView on unpkg · L124

llms-full.txtView file

7538patternName = generic_password severity = medium line = 7538 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in llms-full.txt

llms-full.txtView on unpkg · L7538

Source & flagged code

16 flagged · loading source

contexts/ApiKeyContext.tsxView file

46patternName = google_api_key severity = high line = 46 matchedText = 'AIzaSyA...q0',

High

High Secret

Package contains a high-severity secret pattern.

contexts/ApiKeyContext.tsxView on unpkg · L46

46patternName = google_api_key severity = high line = 46 matchedText = 'AIzaSyA...q0',

High

Secret Pattern

Google API key in contexts/ApiKeyContext.tsx

contexts/ApiKeyContext.tsxView on unpkg · L46

dist/BrandColorsContext-BNKLUVcU.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-BNKLUVcU.js

dist/BrandColorsContext-BNKLUVcU.jsView on unpkg · L22

dist/BrandColorsContext-B25Bpr3b.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-B25Bpr3b.cjs

dist/BrandColorsContext-B25Bpr3b.cjsView on unpkg · L24

dist/BrandColorsContext-DjpC9wR_.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-DjpC9wR_.cjs

dist/BrandColorsContext-DjpC9wR_.cjsView on unpkg · L24

dist/BrandColorsContext-BCieATdW.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-BCieATdW.js

dist/BrandColorsContext-BCieATdW.jsView on unpkg · L22

dist/BrandColorsContext-DNZGHItQ.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-DNZGHItQ.cjs

dist/BrandColorsContext-DNZGHItQ.cjsView on unpkg · L24

dist/BrandColorsContext-DP0DXAXS.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-DP0DXAXS.js

dist/BrandColorsContext-DP0DXAXS.jsView on unpkg · L22

dist/BrandColorsContext-z0O2LlZz.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-z0O2LlZz.js

dist/BrandColorsContext-z0O2LlZz.jsView on unpkg · L22

dist/BrandColorsContext-B4_81eas.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-B4_81eas.cjs

dist/BrandColorsContext-B4_81eas.cjsView on unpkg · L24

dist/BrandColorsContext-V3tOc-Zw.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-V3tOc-Zw.js

dist/BrandColorsContext-V3tOc-Zw.jsView on unpkg · L22

dist/BrandColorsContext-DbK5LnQ_.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-DbK5LnQ_.js

dist/BrandColorsContext-DbK5LnQ_.jsView on unpkg · L22

dist/BrandColorsContext-MpXFhte7.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-MpXFhte7.cjs

dist/BrandColorsContext-MpXFhte7.cjsView on unpkg · L24

dist/BrandColorsContext-Ug_TZ8yn.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-Ug_TZ8yn.cjs

dist/BrandColorsContext-Ug_TZ8yn.cjsView on unpkg · L24

docs/components/pages.mdView file

124patternName = generic_password severity = medium line = 124 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in docs/components/pages.md

docs/components/pages.mdView on unpkg · L124

llms-full.txtView file

7538patternName = generic_password severity = medium line = 7538 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in llms-full.txt

llms-full.txtView on unpkg · L7538

Findings

14 High3 Medium7 Low

HighHigh Secretcontexts/ApiKeyContext.tsx

HighSecret Patterncontexts/ApiKeyContext.tsx

HighSecret Patterndist/BrandColorsContext-BNKLUVcU.js

HighSecret Patterndist/BrandColorsContext-B25Bpr3b.cjs

HighSecret Patterndist/BrandColorsContext-DjpC9wR_.cjs

HighSecret Patterndist/BrandColorsContext-BCieATdW.js

HighSecret Patterndist/BrandColorsContext-DNZGHItQ.cjs

HighSecret Patterndist/BrandColorsContext-DP0DXAXS.js

HighSecret Patterndist/BrandColorsContext-z0O2LlZz.js

HighSecret Patterndist/BrandColorsContext-B4_81eas.cjs

HighSecret Patterndist/BrandColorsContext-V3tOc-Zw.js

HighSecret Patterndist/BrandColorsContext-DbK5LnQ_.js

HighSecret Patterndist/BrandColorsContext-MpXFhte7.cjs

HighSecret Patterndist/BrandColorsContext-Ug_TZ8yn.cjs

MediumNetwork

MediumSecret Patterndocs/components/pages.md

MediumSecret Patternllms-full.txt

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

16 flagged

contexts/ApiKeyContext.tsxView file

Lines 26-66tsx

26 if (typeof window === 'undefined') return;

27 window.localStorage?.removeItem(key);

28};

30interface ApiKeyProviderProps {

31 children: ReactNode;

32 initialApiKey?: string;

33 initialGeminiApiKey?: string;

34 initialGoogleMapsApiKey?: string;

35}

37export function ApiKeyProvider({

38 children,

39 initialApiKey,

40 initialGeminiApiKey,

41 initialGoogleMapsApiKey,

42}: ApiKeyProviderProps) {

43 // Lista de chaves conhecidas como vazadas (para limpeza automática)

44 const LEAKED_KEYS = [

45 'AIzaSyCMsAMytBeOK0Qd7RKFyA5IW9eWt2WTJg',

46 'AIzaSyAiYWEIEmx212Up9zfM8kqyMXB4jLs8gq0',

High

High Secret

Package contains a high-severity secret pattern.

contexts/ApiKeyContext.tsxView on unpkg · L46

High

Secret Pattern

Google API key in contexts/ApiKeyContext.tsx

contexts/ApiKeyContext.tsxView on unpkg · L46

47 ];

49 const [apiKey, setApiKeyState] = useState<string>(() => {

50 if (initialApiKey) return initialApiKey;

51 const saved = readStorage('xertica-api-key');

52 return saved || '';

53 });

55 const [geminiApiKey, setGeminiApiKeyState] = useState<string>(() => {

56 if (initialGeminiApiKey) return initialGeminiApiKey;

57 const saved = readStorage('xertica-gemini-api-key');

59 // Se a chave salva estiver na lista de vazadas, removê-la

60 if (saved && LEAKED_KEYS.includes(saved)) {

61 removeStorage('xertica-gemini-api-key');

62 return '';

63 }

65 return saved || '';

66 });

dist/BrandColorsContext-BNKLUVcU.jsView file

Lines 2-42javascript

2import React__default, { createContext, useState, useEffect, useContext } from 'react';

4const ApiKeyContext = createContext(void 0);

5const readStorage = (key) => typeof window !== "undefined"

dist/BrandColorsContext-B25Bpr3b.cjsView file

Lines 4-44javascript

4const React = require('react');

6const ApiKeyContext = React.createContext(void 0);

7const readStorage = (key) => typeof window !==

dist/BrandColorsContext-DjpC9wR_.cjsView file

Lines 4-44javascript

4const React = require('react');

6const ApiKeyContext = React.createContext(void 0);

7const readStorage = (key) => typeof window !==

dist/BrandColorsContext-BCieATdW.jsView file

Lines 2-42javascript

2import React__default, { createContext, useState, useEffect, useContext } from 'react';

4const ApiKeyContext = createContext(void 0);

5const readStorage = (key) => typeof window !== "undefined"

dist/BrandColorsContext-DNZGHItQ.cjsView file

Lines 4-44javascript

4const React = require('react');

6const ApiKeyContext = React.createContext(void 0);

7const readStorage = (key) => typeof window !==

dist/BrandColorsContext-DP0DXAXS.jsView file

Lines 2-42javascript

2import React__default, { createContext, useState, useEffect, useContext } from 'react';

4const ApiKeyContext = createContext(void 0);

5const readStorage = (key) => typeof window !== "undefined"

dist/BrandColorsContext-z0O2LlZz.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-z0O2LlZz.js

dist/BrandColorsContext-z0O2LlZz.jsView on unpkg · L22

dist/BrandColorsContext-B4_81eas.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-B4_81eas.cjs

dist/BrandColorsContext-B4_81eas.cjsView on unpkg · L24

dist/BrandColorsContext-V3tOc-Zw.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-V3tOc-Zw.js

dist/BrandColorsContext-V3tOc-Zw.jsView on unpkg · L22

dist/BrandColorsContext-DbK5LnQ_.jsView file

22patternName = google_api_key severity = high line = 22 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-DbK5LnQ_.js

dist/BrandColorsContext-DbK5LnQ_.jsView on unpkg · L22

dist/BrandColorsContext-MpXFhte7.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-MpXFhte7.cjs

dist/BrandColorsContext-MpXFhte7.cjsView on unpkg · L24

dist/BrandColorsContext-Ug_TZ8yn.cjsView file

24patternName = google_api_key severity = high line = 24 matchedText = "AIzaSyA...gq0"

High

Secret Pattern

Google API key in dist/BrandColorsContext-Ug_TZ8yn.cjs

dist/BrandColorsContext-Ug_TZ8yn.cjsView on unpkg · L24

docs/components/pages.mdView file

124patternName = generic_password severity = medium line = 124 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in docs/components/pages.md

docs/components/pages.mdView on unpkg · L124

llms-full.txtView file

7538patternName = generic_password severity = medium line = 7538 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in llms-full.txt

llms-full.txtView on unpkg · L7538