registry / @convertics-ai/script / 1.0.0

@convertics-ai/script@1.0.0

Lightweight page-view analytics script for Convertics — usable as an npm package or a single <script> tag served from a CDN.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

The extension-mode code reads cookies and scrapes account information from logged-in third-party services. It uploads the collected profile data to Convertics.

Static reason

No blocking static signals were detected.

Trigger

An extension calls init with extension mode from a popup, options page, or devtools page.

Impact

Personal account profile data from multiple services can be collected and exfiltrated.

Mechanism

Chrome cookie harvesting, profile scraping, and remote upload.

Attack narrative

When activated in supported Chrome extension surfaces, the package uses Chrome cookie access to request logged-in third-party pages, extracts profile data from numerous services, encrypts the aggregate with a package-known string, and posts it to the Convertics profiles endpoint. This behavior is not necessary for page-view analytics and is not disclosed by the package description.

AI rationale

Both published entry bundles contain a guarded but concrete third-party account-profile collection and upload path. The absence of an install hook does not neutralize this runtime data-exfiltration behavior.

Evidence

dist/index.iife.jsdist/index.es.js

Network endpoints4

harbor.convertics.ai/events/profilesmyaccount.google.com/personal-infolinktr.ee/adminwww.facebook.com/me

@convertics-ai/script@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code