registry / @adminide-stack/yantra-help-browser / 12.0.193
@adminide-stack/yantra-help-browser@12.0.193
Sample core for higher packages to depend on
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install hook, and the entry point sets up a UI feature. The flagged key is an application configuration value, while the only identified external submission sends user-entered form data to EmailJS after form submission.
Static reason
One or more suspicious static signals were detected.
Trigger
Contact email requests are sent after a user submits the contact or feedback form.
Impact
No hostile impact identified; submitted messages are delivered to the configured support inbox.
Mechanism
The form sends the entered support message and related form fields to EmailJS using its public client API.
AI rationale
The manifest has no install hook, and the entry point sets up a UI feature. The flagged key is an application configuration value, while the only identified external submission sends user-entered form data to EmailJS after form submission.
Network endpoints1
api.emailjs.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has build, test, and prepublish scripts, with no install lifecycle hook.
- The entry point exports a UI feature, and module setup configures routes and visual components.
- The Google Maps key appears as an application configuration default; no use beyond that declaration was found in the package source.
- EmailJS is described as using a public client-side key, and its sender transmits contact form fields to api.emailjs.com when invoked by the form handler.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/config.jsView file
22patternName = google_api_key
severity = high
line = 22
High
22patternName = google_api_key
severity = high
line = 22
High
20//////////////
GOOGLE_MAPS_API_KEY: str({
default: 'AIza[redacted]'
}),
PROPERTY_SEARCH_DEFAULT_PAGE_SIZE: num({
default: 10,
desc: 'Number of pr
Low
Ai Review Evidence
The Google Maps key appears as an application configuration default; no use beyond that declaration was found in the package source.
lib/config.jsView on unpkg · L2039on'
}),
/** EmailJS (https://www.emailjs.com/) — public key is safe for client-side use */
/** Inbox for contact/feedback; passed to EmailJS as support_email — set template "To" to
Findings
2 High1 Medium9 Low
HighHigh Secretlib/config.js
HighSecret Patternlib/config.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/config.js
LowAi Review Evidencelib/config.js
LowAi Review Evidencelib/utils/sendContactEmail.js
LowAi Review Evidencelib/pages/Contact/index.js
Affected versions and remediation
This report applies to @adminide-stack/yantra-help-browser@12.0.193.
See all versions of @adminide-stack/yantra-help-browser for other recorded verdicts.
- Review the evidence and your use of @adminide-stack/yantra-help-browser@12.0.193 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.