Loading npm security reports…

@8wave/ai-elements: Suspicious npm security report (Warn) | LPM Firewall

registry / @8wave/ai-elements / 0.114.0

@8wave/ai-elements@0.114.0

AI chat components and utilities for the Eight Wave Agent Studio platform. The package offers multiple entry points depending on your use case — from a drop-in web component to a framework-agnostic API client.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No malicious attack was identified. The main bundle contains browser telemetry directed to the vendor service, but inspected source did not establish credential collection or an unrelated destination.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Telemetry initialization when the relevant bundled browser component is used.

Impact

The inspected behavior does not establish credential theft, account hijacking, or other concrete malicious impact.

Mechanism

The bundle dynamically loads a browser telemetry module and configures its exporter for the 8wave API endpoint.

AI rationale

Source inspection supports a clean verdict: package.json has no install lifecycle hook, and the reported telemetry endpoint is package-aligned. The inspected flagged Vue and iconify paths did not substantiate scanner claims of account hijacking or malware.

Evidence

dist/ai-elements.es.js

Network endpoints1

ai-api.8wave.it/api/otel

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Source & flagged code

7 flagged · loading source

dist/_chunks/index.es-CvfaFCuJ.jsView file

30patternName = generic_password severity = medium line = 30

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/_chunks/index.es-CvfaFCuJ.jsView on unpkg · L30

dist-vue/index.jsView file

227title: c(), L228: body: c().nullable(), L229: groupKey: c().nullable(), ... L877: try { L878: let r = a ? JSON.parse(a) : null; L879: i = !0, t.value = r ? ka(r) : "object", n.value = r ? Aa(r) : [], e.value = r, vr(() => { ... L1728: }), r; L1729: }, q = "md-editor", Bo = "MdEditor", Vo = "https://unpkg.com", Ho = `${Vo}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, Uo = { L1730: main: `${Vo}/prettier@3.8.1/standalone.js`, ... L2543: if (typeof e == "string") { L2544: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2545: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L227

1142Cr(async () => { L1143: let { CodeEditor: e } = await import("monaco-editor-vue3"); L1144: l.value = e;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/index.jsView on unpkg · L1142

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkAlreadyLinked\":\"Questo account è già collegato a un altro utente. Accedi con quell'utente per scollegarlo prima.\",\"accountLin... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", modelEndpointBaseUrl: "https://internal-proxy/v1", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com",

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/_chunks/dist-Csm5xBQw.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-Csm5xBQw.js#virtual:normalized:round1View on unpkg

dist/_chunks/iconify-CN8mivJ9.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.109.0 matchedPath = dist/_chunks/iconify-CpjEsXoO.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.109.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/_chunks/iconify-CN8mivJ9.jsView on unpkg

dist/_chunks/web-CEmtEYdH.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Hardcoded password in dist/_chunks/web-CEmtEYdH.js

dist/_chunks/web-CEmtEYdH.jsView on unpkg · L7027

Source & flagged code

7 flagged

dist/_chunks/index.es-CvfaFCuJ.jsView file

Lines 10-50javascript

10 try {

11 return window.localStorage.getItem(""), j(e, t);

12 } catch (e) {

13 return k.warn("[useSafeLocalStorage] localStorage blocked, falling back to in-memory ref", e), S(t);

14 }

15}

16//#endregion

17//#region ../../packages/composable/src/useLocalizedString.ts

18l(), y();

19function I(e, t) {

20 let { locale: n, t: r, te: i } = O({ useScope: "global" });

21 return x(() => {

22 let a = D(e), o = t !== void 0 && i(t) ? r(t) : void 0;

23 return a && a[n.value] || o;

24 });

25}

26//#endregion

27//#region ../../node_modules/.pnpm/@volverjs+form-vue@1.1.7_@volverjs+ui-vue@0.0.24_@json-render+core@0.19.0_zod@4.6.5__@v_fb448da8ec0422d842f06e4ec4630257/node_modules/@volverjs/form-vue/dist/index.es.js

28l(), y(), C();

29var L = /* @__PURE__ */ function(e) {

30 return e.text = "text", e.number = "number", e.email = "email", e.password = "password", e.tel = "tel", e.url = "url", e.search = "search", e.date = "date", e.time

31}({}), R = /* @__PURE__ */ function(e) {

32 return e.invalid = "invalid", e.valid = "valid", e.submitting = "submitting", e.reset = "reset", e.updated = "updated", e.unknown = "unknown", e;

33}({}), z = (e) => e._def.typeName === "ZodObject", B = (e) => e._zod.def.type === "object", V = (e) => e._def.typeName === "ZodDefault"

34function q(e) {

35 let t = e;

36 for (; oe(t);) t = t.innerType();

37 return t;

38}

39function J(e) {

40 let t = e;

41 for (; G(t);) t = K(t._zod.def.out) ? t._zod.def.in : t._zod.def.out;

42 return t;

43}

44var se = (e) => {

45 let t = q(e);

46 return U(t) && (t = t._def.innerType), t;

47}, ce = (e) => {

48 let t = J(e);

49 return W(t) && (t = t._zod.def.innerType), t;

50}, le = (e) => !!U(q(e)), ue = (e) => !!W(J(e)), Y = (e) => "_zod"

Long lines were clipped for display.

dist-vue/index.jsView file

227title: c(), L228: body: c().nullable(), L229: groupKey: c().nullable(), ... L877: try { L878: let r = a ? JSON.parse(a) : null; L879: i = !0, t.value = r ? ka(r) : "object", n.value = r ? Aa(r) : [], e.value = r, vr(() => { ... L1728: }), r; L1729: }, q = "md-editor", Bo = "MdEditor", Vo = "https://unpkg.com", Ho = `${Vo}/@highlightjs/cdn-assets@11.11.1/highlight.min.js`, Uo = { L1730: main: `${Vo}/prettier@3.8.1/standalone.js`, ... L2543: if (typeof e == "string") { L2544: if (window.isSecureContext && navigator.clipboard) return await navigator.clipboard.writeText(e); L2545: {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist-vue/index.jsView on unpkg · L227

1142Cr(async () => { L1143: let { CodeEditor: e } = await import("monaco-editor-vue3"); L1144: l.value = e;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-vue/index.jsView on unpkg · L1142

dist/ai-elements.es.jsView file

•Browser cookie sent to a fixed external endpoint in dist/ai-elements.es.js: message: /* @__PURE__ */ JSON.parse("{\"accountLinkAlreadyLinked\":\"Questo account è già collegato a un altro utente. Accedi con quell'utente per scollegarlo prima.\",\"accountLin... apiToolUrl: "https://api.example.com/resource/{param}", insertOrigin: "https://example.com", modelEndpointBaseUrl: "https://internal-proxy/v1", oauthAuthorizationUrl: "es. https://provider.com/oauth/authorize", oauthTokenUrl: "es. https://provider.com/oauth/token", sitemapUrl: "https://example.com/sitemap.xml", startUrl: "https://example.com",

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ai-elements.es.jsView on unpkg

dist-vue/_chunks/dist-Csm5xBQw.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-vue/_chunks/dist-Csm5xBQw.js#virtual:normalized:round1View on unpkg

dist/_chunks/iconify-CN8mivJ9.jsView file

•matchType = normalized_sha256 matchedPackage = @8wave/ai-elements@0.109.0 matchedPath = dist/_chunks/iconify-CpjEsXoO.js matchedIdentity = npm:QDh3YXZlL2FpLWVsZW1lbnRz:0.109.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/_chunks/iconify-CN8mivJ9.jsView on unpkg

dist/_chunks/web-CEmtEYdH.jsView file

7027patternName = generic_password severity = medium line = 7027

Medium

Secret Pattern

Hardcoded password in dist/_chunks/web-CEmtEYdH.js

dist/_chunks/web-CEmtEYdH.jsView on unpkg · L7027