registry / @addressiq/iqcollect-web / 0.5.2

@addressiq/iqcollect-web@0.5.2

AddressIQ IQCollect web SDK — address collection only. For verification use the mobile SDKs.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Opt-in browser address-collection SDK. After a consumer creates `IQCollect` and calls `open()`, it fetches AddressIQ configuration/reference data and can submit user-entered address and consented location details. No confirmed malicious or hidden attack surface is present.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer constructs `IQCollect`, calls `open()`, and the user proceeds through collection or invokes `submit()`.

Impact

Expected collection of address, location, and optional integrator-supplied prefill data by the AddressIQ service.

Mechanism

Fixed-host HTTPS API requests, Google Maps script loading, and user-mediated browser/native geolocation.

Rationale

Source behavior matches the documented browser address-collection SDK: user-triggered UI, geolocation, and fixed service endpoints. The embedded Google Maps key explains the scanner secret signal but is a browser client key, not a concrete malicious chain.

Evidence

package.jsonREADME.mddist/index.d.tsdist/types.d.tsdist/index.cjs.jsdist/index.esm.js

Network endpoints3

api.addressiqpro.comapi-staging.addressiqpro.commaps.googleapis.com/maps/api/js

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.cjs.js` embeds a Google Maps browser API key.
`dist/index.cjs.js` sends entered address fields and selected coordinates to AddressIQ APIs after user flow submission.

Evidence against

`package.json` has no lifecycle hooks or executable bin.
`dist/index.cjs.js` rejects non-browser construction and performs no import-time network request.
Network hosts are fixed AddressIQ/Google Maps endpoints; consumers cannot supply an arbitrary API URL.
No eval, dynamic code loading, Node filesystem/shell access, credential harvesting, persistence, or AI-agent control-surface writes were found.
Geolocation is requested through the browser/native provider during the collection flow, not automatically at package install/import.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 191 KB of source, external domains: addressiqpro.com, api-staging.addressiqpro.com, api.addressiqpro.com, cdn-staging.addressiqpro.com, cdn.addressiqpro.com, docs.addressiqpro.com, ingest-api-staging.addressiqpro.com, ingest-api.addressiqpro.com, maps.googleapis.com, www.w3.org

Source & flagged code

6 flagged

dist/index.cjs.jsView file

Lines 677-746javascript

677.iq-primary{background:var(--iq-primary,#ff6b35);color:#fff}

678.iq-secondary{background:#f3f4f6;color:var(--iq-secondary,#111827)}

679.iq-outline .iq-primary{background:transparent;color:var(--iq-primary,#ff6b35);border:1.5px solid var(--iq-primary,#ff6b35)}

680`;

681 document.head.appendChild(style);

682}

683

684/**

685 * Build-time configuration baked into the bundle by Rollup.

686 *

687 * `@rollup/plugin-replace` (see rollup.config.mjs — plugin-replace IS this

688 * repo's baking mechanism, the equivalent of the mobile SDKs' generated

689 * BuildConfig source file) substitutes each `__ADDRESSIQ_*__` global with a

690 * string literal sourced from the GitHub environment at build time — three

691 * URLs per shippable environment, from the repository variables:

692 *

693 * STAGING_ADDRESSIQ_API_BASE_URL PROD_ADDRESSIQ_API_BASE_URL

694 * STAGING_ADDRESSIQ_INGEST_BASE_URL PROD_ADDRESSIQ_INGEST_BASE_URL

695 * STAGING_ADDRESSIQ_CDN_BASE_URL PROD_ADDRESSIQ_CDN_BASE_URL

696 *

697 * plus `"AIzaSyCimgqReP96j_njFnMMLARqD5iEpCwey1w"` from the `GOOGLE_MAPS_SDK_KEY` secret.

High

High Secret

Package contains a high-severity secret pattern.

dist/index.cjs.jsView on unpkg · L697

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L697

698 * Integrators never provide any of these values.

699 *

700 * `development` is deliberately NOT baked from CI: it points at a backend on

701 * the developer's own machine, so it is a local-only concern and stays a

702 * literal (http://localhost:4000) in ENVIRONMENT_URLS. Never ship a build

703 * configured for `development`.

704 *

705 * The fallbacks below are the safe public defaults, so a local `npm run build`

706 * with no env vars set still resolves real hosts. The `typeof` guards keep this

707 * file safe under `tsc --noEmit` and Jest, where the globals are never defined

708 * and no replacement happens — those runs fall back to the same defaults.

709 */

710const BUILD_CONFIG = {

711 /** Staging hosts. Rollup injects the GH `STAGING_*_BASE_URL` variables. */

712 stagingApiUrl: "https://api-staging.addressiqpro.com"

713 ,

714 stagingIngestUrl: "https://ingest-api-staging.addressiqpro.com"

715 ,

716 stagingCdnUrl: "https://cdn-staging.addressiqpro.com"

717 ,

718 /** Production hosts. Rollup injects the GH `PROD_*_BASE_URL` variables. */

719 prodApiUrl: "https://api.addressiqpro.com"

720 ,

721 prodIngestUrl: "https://ingest-api.addressiqpro.com"

722 ,

723 prodCdnUrl: "https://cdn.addressiqpro.com"

724 ,

725 /** Default Google Maps JS key. Rollup injects the GH `GOOGLE_MAPS_SDK_KEY` secret. */

726 mapsKey: "AIzaSyCimgqReP96j_njFnMMLARqD5iEpCwey1w"

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L726

727 ,

728};

729

730const ACCORDION = [

731 {

732 icon: 'user',

733 heading: 'We process personal data',

734 body: (biz) => `To deliver its service to you, ${biz} uses AddressIQ to collect and verify your address. ` +

735 'This means we need to store and process some personal and location data. Our address ' +

736 "verification uses some background location data when you're at your address.",

737 },

738 {

739 icon: 'shield',

740 heading: 'Your data belongs to you',

741 body: () => 'Your data is yours. You can request access to it or ask us to delete it at any time, and ' +

742 'we only use it to verify and update your address.',

743 },

744 {

745 icon: 'lock',

746 heading: 'We keep your data safe',

dist/iqcollect.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:

dist/index.esm.jsView file

Lines 675-744javascript

675.iq-primary{background:var(--iq-primary,#ff6b35);color:#fff}

676.iq-secondary{background:#f3f4f6;color:var(--iq-secondary,#111827)}

677.iq-outline .iq-primary{background:transparent;color:var(--iq-primary,#ff6b35);border:1.5px solid var(--iq-primary,#ff6b35)}

Source & flagged code

6 flagged · loading source

dist/index.cjs.jsView file

697patternName = google_api_key severity = high line = 697 matchedText = * plus `...ret.

High

High Secret

Package contains a high-severity secret pattern.

dist/index.cjs.jsView on unpkg · L697

697patternName = google_api_key severity = high line = 697 matchedText = * plus `...ret.

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L697

726patternName = google_api_key severity = high line = 726 matchedText = mapsKey:...y1w"

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L726

dist/iqcollect.jsView file

1patternName = google_api_key severity = high line = 1 matchedText = !functio...y});

High

Secret Pattern

Google API key in dist/iqcollect.js

dist/iqcollect.jsView on unpkg · L1

dist/index.esm.jsView file

695patternName = google_api_key severity = high line = 695 matchedText = * plus `...ret.

High

Secret Pattern

Google API key in dist/index.esm.js

dist/index.esm.jsView on unpkg · L695

724patternName = google_api_key severity = high line = 724 matchedText = mapsKey:...y1w"

High

Secret Pattern

Google API key in dist/index.esm.js

dist/index.esm.jsView on unpkg · L724

Findings

6 High1 Medium4 Low

HighHigh Secretdist/index.cjs.js

HighSecret Patterndist/index.cjs.js

HighSecret Patterndist/iqcollect.js

HighSecret Patterndist/index.esm.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/index.cjs.jsView file

Lines 677-746javascript

677.iq-primary{background:var(--iq-primary,#ff6b35);color:#fff}

678.iq-secondary{background:#f3f4f6;color:var(--iq-secondary,#111827)}

679.iq-outline .iq-primary{background:transparent;color:var(--iq-primary,#ff6b35);border:1.5px solid var(--iq-primary,#ff6b35)}

680`;

681 document.head.appendChild(style);

682}

683

684/**

685 * Build-time configuration baked into the bundle by Rollup.

686 *

687 * `@rollup/plugin-replace` (see rollup.config.mjs — plugin-replace IS this

688 * repo's baking mechanism, the equivalent of the mobile SDKs' generated

689 * BuildConfig source file) substitutes each `__ADDRESSIQ_*__` global with a

690 * string literal sourced from the GitHub environment at build time — three

691 * URLs per shippable environment, from the repository variables:

692 *

693 * STAGING_ADDRESSIQ_API_BASE_URL PROD_ADDRESSIQ_API_BASE_URL

694 * STAGING_ADDRESSIQ_INGEST_BASE_URL PROD_ADDRESSIQ_INGEST_BASE_URL

695 * STAGING_ADDRESSIQ_CDN_BASE_URL PROD_ADDRESSIQ_CDN_BASE_URL

696 *

697 * plus `"AIzaSyCimgqReP96j_njFnMMLARqD5iEpCwey1w"` from the `GOOGLE_MAPS_SDK_KEY` secret.

High

High Secret

Package contains a high-severity secret pattern.

dist/index.cjs.jsView on unpkg · L697

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L697

698 * Integrators never provide any of these values.

699 *

700 * `development` is deliberately NOT baked from CI: it points at a backend on

701 * the developer's own machine, so it is a local-only concern and stays a

702 * literal (http://localhost:4000) in ENVIRONMENT_URLS. Never ship a build

703 * configured for `development`.

704 *

705 * The fallbacks below are the safe public defaults, so a local `npm run build`

706 * with no env vars set still resolves real hosts. The `typeof` guards keep this

707 * file safe under `tsc --noEmit` and Jest, where the globals are never defined

708 * and no replacement happens — those runs fall back to the same defaults.

709 */

710const BUILD_CONFIG = {

711 /** Staging hosts. Rollup injects the GH `STAGING_*_BASE_URL` variables. */

712 stagingApiUrl: "https://api-staging.addressiqpro.com"

713 ,

714 stagingIngestUrl: "https://ingest-api-staging.addressiqpro.com"

715 ,

716 stagingCdnUrl: "https://cdn-staging.addressiqpro.com"

717 ,

718 /** Production hosts. Rollup injects the GH `PROD_*_BASE_URL` variables. */

719 prodApiUrl: "https://api.addressiqpro.com"

720 ,

721 prodIngestUrl: "https://ingest-api.addressiqpro.com"

722 ,

723 prodCdnUrl: "https://cdn.addressiqpro.com"

724 ,

725 /** Default Google Maps JS key. Rollup injects the GH `GOOGLE_MAPS_SDK_KEY` secret. */

726 mapsKey: "AIzaSyCimgqReP96j_njFnMMLARqD5iEpCwey1w"

High

Secret Pattern

Google API key in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L726

727 ,

728};

729

730const ACCORDION = [

731 {

732 icon: 'user',

733 heading: 'We process personal data',

734 body: (biz) => `To deliver its service to you, ${biz} uses AddressIQ to collect and verify your address. ` +

735 'This means we need to store and process some personal and location data. Our address ' +

736 "verification uses some background location data when you're at your address.",

737 },

738 {

739 icon: 'shield',

740 heading: 'Your data belongs to you',

741 body: () => 'Your data is yours. You can request access to it or ask us to delete it at any time, and ' +

742 'we only use it to verify and update your address.',

743 },

744 {

745 icon: 'lock',

746 heading: 'We keep your data safe',

dist/iqcollect.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:

dist/index.esm.jsView file

Lines 675-744javascript

675.iq-primary{background:var(--iq-primary,#ff6b35);color:#fff}

676.iq-secondary{background:#f3f4f6;color:var(--iq-secondary,#111827)}

677.iq-outline .iq-primary{background:transparent;color:var(--iq-primary,#ff6b35);border:1.5px solid var(--iq-primary,#ff6b35)}