registry / @adminide-stack/yantra-help-browser / 12.0.192-alpha.2
@adminide-stack/yantra-help-browser@12.0.192-alpha.2
Sample core for higher packages to depend on
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe scanner’s network and secret-like signals resolve to a user-triggered contact workflow and application configuration, including an explicitly public EmailJS key. The manifest has no install hook, and inspected runtime code establishes no malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user submits the contact or feedback form.
Impact
Submitted messages are delivered to the support workflow; the inspected code does not show unrelated data collection or transfer.
Mechanism
The form handler sends the entered fields to the configured EmailJS service endpoint.
AI rationale
The scanner’s network and secret-like signals resolve to a user-triggered contact workflow and application configuration, including an explicitly public EmailJS key. The manifest has no install hook, and inspected runtime code establishes no malicious behavior.
Evidence
lib/utils/sendContactEmail.jslib/pages/Contact/index.jslib/pages/Feedback/index.js
Network endpoints1
api.emailjs.com/api/v1.0/email/send
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json declares lib/index.js as the entrypoint and has no install lifecycle hook.
- The entrypoint creates a UI feature from the package settings.
- Configuration identifies the EmailJS key as public and describes the support inbox as the recipient.
- The EmailJS helper posts contact or feedback form fields to api.emailjs.com.
- The contact and feedback send calls occur in their respective form submission handlers.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/config.jsView file
22patternName = google_api_key
severity = high
line = 22
High
22patternName = google_api_key
severity = high
line = 22
High
41/** EmailJS (https://www.emailjs.com/) — public key is safe for client-side use */
/** Inbox for contact/feedback; passed to EmailJS as support_email — set template "To" to {{support_email}} */
SUPPORT_EMAIL: str({
default: 'support@yantra.app',
desc: 'Support inbox (EmailJS recipient via template variable)'
}),
EMAILJS_PUBLIC_KEY: str({
default:
Low
Ai Review Evidence
Configuration identifies the EmailJS key as public and describes the support inbox as the recipient.
lib/config.jsView on unpkg · L41Findings
2 High1 Medium9 Low
HighHigh Secretlib/config.js
HighSecret Patternlib/config.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/config.js
LowAi Review Evidencelib/utils/sendContactEmail.js
LowAi Review Evidencelib/utils/sendContactEmail.js
LowAi Review Evidencelib/pages/Contact/index.js
Affected versions and remediation
This report applies to @adminide-stack/yantra-help-browser@12.0.192-alpha.2.
See all versions of @adminide-stack/yantra-help-browser for other recorded verdicts.
- Review the evidence and your use of @adminide-stack/yantra-help-browser@12.0.192-alpha.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.