registry / @addressiq/iqcollect-web / 0.4.0

@addressiq/iqcollect-web@0.4.0

AddressIQ IQCollect web SDK — address collection only. For verification use the mobile SDKs.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The browser SDK loads Google Maps and sends consented address-collection data to fixed AddressIQ endpoints after consumer activation.

Static reason

One or more suspicious static signals were detected.

Trigger

A host application constructs `IQCollect`, calls `open()`, and a user proceeds through the address/location flow.

Impact

Expected collection of address and location data for the SDK's stated function; no install-time or covert host compromise established.

Mechanism

Browser address collection, geolocation, and fixed-host API requests.

Rationale

Direct inspection shows a user-invoked browser address-collection widget with fixed platform and Maps integrations, not malicious package behavior. The scanner's secret/network signals correspond to documented Maps configuration and the package's core API flow.

Evidence

package.jsonREADME.mddist/index.cjs.jsdist/index.esm.jsdist/index.d.tsdist/index.cjs.js.map

Network endpoints6

api.addressiqpro.comapi-staging.addressiqpro.comlocalhost:3355maps.googleapis.com/maps/api/jsaddressiqpro.com/termsaddressiqpro.com/privacy

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.cjs.js` embeds a Google Maps browser API key and loads the Maps script.
`dist/index.cjs.js` sends configured address, location, and user ID data to AddressIQ collection endpoints.

Evidence against

`package.json` has no preinstall/install/postinstall hooks or executable bin entry.
Runtime starts only when consumer constructs `IQCollect` and calls `open()`.
Network hosts are fixed AddressIQ environment URLs plus Google Maps, matching an address-collection SDK.
No child-process, filesystem, eval, dynamic loading, cookie harvesting, WebSocket, or persistence primitives found.
`dist/index.cjs.js` uses browser geolocation and address submission only through its visible UI/API flow.
The apparent secret is documented build configuration for the browser Maps integration, not a hidden credential harvester.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 198 KB of source, external domains: addressiqpro.com, api-staging.addressiqpro.com, api.addressiqpro.com, cdn.addressiqpro.com, docs.addressiqpro.com, maps.googleapis.com, www.w3.org

Source & flagged code

6 flagged

dist/index.cjs.jsView file

Lines 676-729javascript

676.iq-map-pin{position:absolute;left:50%;top:50%;transform:translate(-50%,-100%);pointer-events:none;z-index:5;color:var(--iq-primary,#ff6b35)}

677.iq-map-pin svg{display:block;filter:drop-shadow(0 2px 2px rgba(0,0,0,.35))}

678.iq-section{font-size:12px;font-weight:700;text-transform:uppercase;letter-spacing:.05em;color:#9ca3af;margin-top:6px}

679.iq-field{display:flex;flex-direction:column;gap:6px}

680.iq-row{display:flex;gap:10px}

681.iq-row>*{flex:1;min-width:0}

682.iq-consent{display:flex;gap:10px;align-items:flex-start;font-size:14px}

683.iq-footer{display:flex;gap:12px;margin-top:auto}

684.iq-btn{flex:1;border:0;border-radius:var(--iq-radius,12px);padding:14px;font-size:15px;font-weight:600;cursor:pointer}

685.iq-primary{background:var(--iq-primary,#ff6b35);color:#fff}

686.iq-secondary{background:#f3f4f6;color:var(--iq-secondary,#111827)}

687.iq-outline .iq-primary{background:transparent;color:var(--iq-primary,#ff6b35);border:1.5px solid var(--iq-primary,#ff6b35)}

688`;

689 document.head.appendChild(style);

690}

691

692/**

693 * Build-time configuration baked into the bundle by Rollup.

694 *

695 * `@rollup/plugin-replace` substitutes `"https://api.addressiqpro.com"` and

696 * `"AIzaSyCimgqReP96j_njFnMMLARqD5iEpCwey1w"` with string literals sourced from the GitHub

High

High Secret

Package contains a high-severity secret pattern.

dist/index.cjs.jsView on unpkg · L696

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L696

697 * environment at build time (the `ADDRESSIQ_API_URL` variable and the

698 * `GOOGLE_MAPS_SDK_KEY` secret). Integrators never provide either value.

699 *

700 * The `typeof` guards keep this file safe under `tsc --noEmit` and Jest, where

701 * the globals are never defined and no replacement happens — those runs fall

702 * back to the defaults below.

703 */

704const BUILD_CONFIG = {

705 /** Production API host. Rollup injects the GH `ADDRESSIQ_API_URL` variable. */

706 apiUrl: "https://api.addressiqpro.com"

707 ,

708 /** Default Google Maps JS key. Rollup injects the GH `GOOGLE_MAPS_SDK_KEY` secret. */

709 mapsKey: "AIzaSyCimgqReP96j_njFnMMLARqD5iEpCwey1w"

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L709

710 ,

711};

712

713const ACCORDION = [

714 {

715 icon: 'user',

716 heading: 'We process personal data',

717 body: (biz) => `To deliver its service to you, ${biz} uses AddressIQ to collect and verify your address. ` +

718 'This means we need to store and process some personal and location data. Our address ' +

719 "verification uses some background location data when you're at your address.",

720 },

721 {

722 icon: 'shield',

723 heading: 'Your data belongs to you',

724 body: () => 'Your data is yours. You can request access to it or ask us to delete it at any time, and ' +

725 'we only use it to verify and update your address.',

726 },

727 {

728 icon: 'lock',

729 heading: 'We keep your data safe',

dist/iqcollect.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:

dist/index.esm.jsView file

Lines 674-727javascript

674.iq-map-pin{position:absolute;left:50%;top:50%;transform:translate(-50%,-100%);pointer-events:none;z-index:5;color:var(--iq-primary,#ff6b35)}

Source & flagged code

6 flagged · loading source

dist/index.cjs.jsView file

696patternName = google_api_key severity = high line = 696 matchedText = * `"AIza...tHub

High

High Secret

Package contains a high-severity secret pattern.

dist/index.cjs.jsView on unpkg · L696

696patternName = google_api_key severity = high line = 696 matchedText = * `"AIza...tHub

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L696

709patternName = google_api_key severity = high line = 709 matchedText = mapsKey:...y1w"

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L709

dist/iqcollect.jsView file

1patternName = google_api_key severity = high line = 1 matchedText = !functio...y});

High

Secret Pattern

Google API key in dist/iqcollect.js

dist/iqcollect.jsView on unpkg · L1

dist/index.esm.jsView file

694patternName = google_api_key severity = high line = 694 matchedText = * `"AIza...tHub

High

Secret Pattern

Google API key in dist/index.esm.js

dist/index.esm.jsView on unpkg · L694

707patternName = google_api_key severity = high line = 707 matchedText = mapsKey:...y1w"

High

Secret Pattern

Google API key in dist/index.esm.js

dist/index.esm.jsView on unpkg · L707

Findings

6 High1 Medium4 Low

HighHigh Secretdist/index.cjs.js

HighSecret Patterndist/index.cjs.js

HighSecret Patterndist/iqcollect.js

HighSecret Patterndist/index.esm.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/index.cjs.jsView file

Lines 676-729javascript

676.iq-map-pin{position:absolute;left:50%;top:50%;transform:translate(-50%,-100%);pointer-events:none;z-index:5;color:var(--iq-primary,#ff6b35)}

677.iq-map-pin svg{display:block;filter:drop-shadow(0 2px 2px rgba(0,0,0,.35))}

678.iq-section{font-size:12px;font-weight:700;text-transform:uppercase;letter-spacing:.05em;color:#9ca3af;margin-top:6px}

679.iq-field{display:flex;flex-direction:column;gap:6px}

680.iq-row{display:flex;gap:10px}

681.iq-row>*{flex:1;min-width:0}

682.iq-consent{display:flex;gap:10px;align-items:flex-start;font-size:14px}

683.iq-footer{display:flex;gap:12px;margin-top:auto}

684.iq-btn{flex:1;border:0;border-radius:var(--iq-radius,12px);padding:14px;font-size:15px;font-weight:600;cursor:pointer}

685.iq-primary{background:var(--iq-primary,#ff6b35);color:#fff}

686.iq-secondary{background:#f3f4f6;color:var(--iq-secondary,#111827)}

687.iq-outline .iq-primary{background:transparent;color:var(--iq-primary,#ff6b35);border:1.5px solid var(--iq-primary,#ff6b35)}

688`;

689 document.head.appendChild(style);

690}

691

692/**

693 * Build-time configuration baked into the bundle by Rollup.

694 *

695 * `@rollup/plugin-replace` substitutes `"https://api.addressiqpro.com"` and

696 * `"AIzaSyCimgqReP96j_njFnMMLARqD5iEpCwey1w"` with string literals sourced from the GitHub

High

High Secret

Package contains a high-severity secret pattern.

dist/index.cjs.jsView on unpkg · L696

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L696

697 * environment at build time (the `ADDRESSIQ_API_URL` variable and the

698 * `GOOGLE_MAPS_SDK_KEY` secret). Integrators never provide either value.

699 *

700 * The `typeof` guards keep this file safe under `tsc --noEmit` and Jest, where

701 * the globals are never defined and no replacement happens — those runs fall

702 * back to the defaults below.

703 */

704const BUILD_CONFIG = {

705 /** Production API host. Rollup injects the GH `ADDRESSIQ_API_URL` variable. */

706 apiUrl: "https://api.addressiqpro.com"

707 ,

708 /** Default Google Maps JS key. Rollup injects the GH `GOOGLE_MAPS_SDK_KEY` secret. */

709 mapsKey: "AIzaSyCimgqReP96j_njFnMMLARqD5iEpCwey1w"

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L709

710 ,

711};

712

713const ACCORDION = [

714 {

715 icon: 'user',

716 heading: 'We process personal data',

717 body: (biz) => `To deliver its service to you, ${biz} uses AddressIQ to collect and verify your address. ` +

718 'This means we need to store and process some personal and location data. Our address ' +

719 "verification uses some background location data when you're at your address.",

720 },

721 {

722 icon: 'shield',

723 heading: 'Your data belongs to you',

724 body: () => 'Your data is yours. You can request access to it or ask us to delete it at any time, and ' +

725 'we only use it to verify and update your address.',

726 },

727 {

728 icon: 'lock',

729 heading: 'We keep your data safe',

dist/iqcollect.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:

dist/index.esm.jsView file

Lines 674-727javascript

674.iq-map-pin{position:absolute;left:50%;top:50%;transform:translate(-50%,-100%);pointer-events:none;z-index:5;color:var(--iq-primary,#ff6b35)}