registry / @convertics-ai/script / 1.0.1

@convertics-ai/script@1.0.1

Lightweight page-view analytics script for Convertics — usable as an npm package or a single <script> tag served from a CDN.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

When initialized in a Chrome extension popup, options, or devtools surface, the package collects authenticated account data from third-party sites. It encrypts that collected profile data and sends it to Harbor.

Static reason

No blocking static signals were detected.

Trigger

Calling init with extension mode in a supported Chrome extension surface.

Impact

Exposure of users' account profile and personal data to harbor.convertics.ai.

Mechanism

Cookie-backed account-profile harvesting and remote data exfiltration.

Attack narrative

The package's extension path uses chrome.cookies to impersonate logged-in users at third-party services, parses account-profile information, encrypts the results, and uploads them to Harbor. This behavior is unrelated to ordinary page-view analytics and activates automatically for supported extension surfaces.

AI rationale

The bundles implement concrete cross-site profile harvesting and exfiltration, including Google account data, despite being presented as a lightweight analytics script. Absence of an install hook does not mitigate this runtime collection behavior.

Evidence

dist/index.es.jsdist/index.iife.js

Network endpoints2

harbor.convertics.ai/events/profilesmyaccount.google.com/personal-info

@convertics-ai/script@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code