registry / @adminide-stack/yantra-help-browser / 12.0.192-alpha.0
@adminide-stack/yantra-help-browser@12.0.192-alpha.0
Sample core for higher packages to depend on
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected entrypoint and network callers implement a help website with user-submitted email forms. Secret-pattern and network hints do not establish malicious behavior, and no automatic install attack or credential harvesting was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Application page loading and explicit form submission activate the inspected behavior.
Impact
Submitted contact information and messages reach the configured support service; no covert credential transfer or consumer file mutation was identified.
Mechanism
React routes load content, while the email helper sends supplied form fields to a fixed EmailJS endpoint.
AI rationale
The inspected entrypoint and network callers implement a help website with user-submitted email forms. Secret-pattern and network hints do not establish malicious behavior, and no automatic install attack or credential harvesting was found.
Network endpoints1
api.emailjs.com/api/v1.0/email/send
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has build and test scripts, with no preinstall, install, postinstall, or runtime self-dependency.
- lib/config.js validates application settings; its embedded API key patterns do not establish credential harvesting.
- lib/index.js constructs a React feature using the package's route and component settings.
- Contact and feedback submissions send user-entered form fields, rather than harvested session credentials.
- The email helper posts JSON to a fixed EmailJS service endpoint; remaining inspected fetches load help content.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/config.jsView file
24patternName = google_api_key
severity = high
line = 24
High
24patternName = google_api_key
severity = high
line = 24
High
2const config = cleanEnv(env, {
HELP_SERVER_URL: str({
default: 'https://help.yantra.app'
}),
Low
Ai Review Evidence
lib/config.js validates application settings; its embedded API key patterns do not establish credential harvesting.
lib/config.jsView on unpkg · L2package.jsonView file
Findings
2 High1 Medium9 Low
HighHigh Secretlib/config.js
HighSecret Patternlib/config.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/config.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/pages/Contact/index.js
LowAi Review Evidencelib/pages/Contact/index.js
LowAi Review Evidencelib/utils/sendContactEmail.js
Affected versions and remediation
This report applies to @adminide-stack/yantra-help-browser@12.0.192-alpha.0.
See all versions of @adminide-stack/yantra-help-browser for other recorded verdicts.
- Review the evidence and your use of @adminide-stack/yantra-help-browser@12.0.192-alpha.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.