registry / @adminide-stack/yantra-help-browser / 12.0.191-alpha.2
@adminide-stack/yantra-help-browser@12.0.191-alpha.2
Sample core for higher packages to depend on
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected entrypoint, configuration, and email callers implement ordinary browser help functionality. Embedded API settings and network references do not demonstrate malicious behavior, and the email destination is fixed to its intended service.
Static reason
One or more suspicious static signals were detected.
Trigger
Page loading retrieves help content; submitting a contact or feedback form activates email sending.
Impact
The inspected behavior delivers submitted messages and displays help content; no malicious execution or credential harvesting was established.
Mechanism
Form values and configured EmailJS identifiers are serialized into a request to a fixed service endpoint; no existing session credential forwarding was found.
AI rationale
The inspected entrypoint, configuration, and email callers implement ordinary browser help functionality. Embedded API settings and network references do not demonstrate malicious behavior, and the email destination is fixed to its intended service.
Network endpoints1
api.emailjs.com/api/v1.0/email/send
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has build and prepublish scripts, no automatic install hooks, and no runtime self-dependency.
- lib/config.js validates application settings; its embedded API settings do not establish credential harvesting.
- The entrypoint registers page routes and interface components.
- Contact and feedback submission handlers send user-entered form fields using configured EmailJS settings.
- The email helper posts JSON to the fixed EmailJS service endpoint.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/config.jsView file
24patternName = google_api_key
severity = high
line = 24
High
24patternName = google_api_key
severity = high
line = 24
High
1import {cleanEnv,str,bool,num}from'envalid';import {getEnvironment}from'@common-stack/core';const env = getEnvironment();
const config = cleanEnv(env, {
HELP_SERVER_URL: str({
default: 'https://help.yantra.app'
}),
Low
Ai Review Evidence
lib/config.js validates application settings; its embedded API settings do not establish credential harvesting.
lib/config.jsView on unpkg · L1Findings
2 High1 Medium9 Low
HighHigh Secretlib/config.js
HighSecret Patternlib/config.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/config.js
LowAi Review Evidencelib/module.js
LowAi Review Evidencelib/pages/Contact/index.js
LowAi Review Evidencelib/pages/Feedback/index.js
LowAi Review Evidencelib/utils/sendContactEmail.js
Affected versions and remediation
This report applies to @adminide-stack/yantra-help-browser@12.0.191-alpha.2.
See all versions of @adminide-stack/yantra-help-browser for other recorded verdicts.
- Review the evidence and your use of @adminide-stack/yantra-help-browser@12.0.191-alpha.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.