registry / @bildit-platform/nextjs / 0.6.2

@bildit-platform/nextjs@0.6.2

BILDIT CMS core integration for Next.js applications

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A shipped but non-public BilditImage module sends render metadata to a localhost ingestion endpoint. It is not reached by the package public entrypoint.

Static reason

No blocking static signals were detected.

Trigger

Direct execution/import of dist/*/components/BilditImage.js and component render.

Impact

Discloses image-prop metadata to a process listening on the local machine.

Mechanism

silent localhost debug telemetry POST

Rationale

The beacon is suspicious but is non-exported, uses only localhost, and no concrete credential theft, persistence, or install-time attack was found. Warn so the unexpected shipped payload is reviewed or removed.

Evidence

package.jsondist/esm/index.jsdist/esm/components/BilditImage.jsdist/cjs/components/BilditImage.jsdist/esm/utils/client.js

Network endpoints1

127.0.0.1:7833/ingest/ab82fcb6-6f48-4ba7-82ef-abf2ff3e6e84

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Unknown with low false-positive risk.

@bildit-platform/nextjs@0.6.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code