registry / @adminide-stack/yantra-help-browser / 12.0.192
@adminide-stack/yantra-help-browser@12.0.192
Sample core for higher packages to depend on
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe flagged configuration values are client-side API identifiers, and the inspected network request is limited to user-submitted contact or feedback content sent to EmailJS. The manifest declares no install lifecycle hook, and the source shows no confirmed attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A visitor submits the Contact or Feedback form.
Impact
This is user-triggered form delivery; no malicious effect was established.
Mechanism
The form passes its entered fields and configured EmailJS identifiers to the EmailJS send endpoint.
AI rationale
The flagged configuration values are client-side API identifiers, and the inspected network request is limited to user-submitted contact or feedback content sent to EmailJS. The manifest declares no install lifecycle hook, and the source shows no confirmed attack behavior.
Evidence
lib/pages/Contact/index.jslib/utils/sendContactEmail.js
Network endpoints1
api.emailjs.com/api/v1.0/email/send
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares build and test scripts, including prepublish, but no install lifecycle hook.
- lib/config.js identifies the EmailJS key as safe for client-side use and configures contact and feedback settings.
- lib/index.js exports a Feature configured through lib/module.js, which uses filtered routes.
- The Contact page sends entered form fields only after the visitor submits the form.
- The send helper posts those fields to the EmailJS REST API.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/config.jsView file
22patternName = google_api_key
severity = high
line = 22
High
22patternName = google_api_key
severity = high
line = 22
High
41/** EmailJS (https://www.emailjs.com/) — public key is safe for client-side use */
/** Inbox for contact/feedback; passed to EmailJS as support_email — set template "To" to {{support_email}} */
Low
Ai Review Evidence
lib/config.js identifies the EmailJS key as safe for client-side use and configures contact and feedback settings.
lib/config.jsView on unpkg · L4121GOOGLE_MAPS_API_KEY: str({
Findings
2 High1 Medium9 Low
HighHigh Secretlib/config.js
HighSecret Patternlib/config.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/config.js
LowAi Review Evidencelib/config.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/module.js
LowAi Review Evidencelib/pages/Contact/index.js
Affected versions and remediation
This report applies to @adminide-stack/yantra-help-browser@12.0.192.
See all versions of @adminide-stack/yantra-help-browser for other recorded verdicts.
- Review the evidence and your use of @adminide-stack/yantra-help-browser@12.0.192 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.