@crystaldesign/widget-image-carousel@26.13.0
Embeddable image carousel widget.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe UMD bundle sends identifying runtime telemetry, including hostname and user email, to a configured endpoint. The destination and credential are supplied by the integrating framework, but the package manifest does not disclose the collection, so this merits a warning.
Static reason
No blocking static signals were detected.
Trigger
When the widget framework initializes the logger with user data, an organization, a URL, a JWT, and a session; widget events can also be logged afterward.
Impact
The configured telemetry service receives identifying user and site details. The destination is integration-configured, but this collection is not described in the package manifest.
Mechanism
The logger includes the page hostname and user ID, email, and name in event data, then POSTs that data to the configured URL's /log endpoint with the configured JWT as a Bearer token.
AI rationale
The UMD bundle sends identifying runtime telemetry, including hostname and user email, to a configured endpoint. The destination and credential are supplied by the integrating framework, but the package manifest does not disclose the collection, so this merits a warning.
Evidence
build/umd/widget-image-carousel.umd.min.js
Network endpoints1
<configured this.url>/log
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The UMD bundle builds an initialization payload containing the page hostname and user ID, email, and name.
- The logger sends events to a configured URL ending in /log and includes its configured JWT as a Bearer token.
- The logger emits its initialization event once user data, organization, URL, JWT, and session are available.
Evidence against
- The package has no install or postinstall hook; its npm scripts run Storybook.
- The manifest points to a conventional ESM widget entry point, and the telemetry endpoint and JWT are supplied through configuration rather than hard-coded in this package.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggedbuild/umd/widget-image-carousel.umd.min.jsView file
2omain:window.location.hostname,applicationEnvironment:v||"SELLER"},user_agent:{browser:h,plattform:c,os:{name:p,version:m},device:{name:d},width:g,height:y,user:{id:null===(C=this.user)||voi
Medium
Ai Review Evidence
The UMD bundle builds an initialization payload containing the page hostname and user ID, email, and name.
build/umd/widget-image-carousel.umd.min.jsView on unpkg · L22ations:[].concat(toConsumableArray_toConsumableArray(r),[t])}),this.checkInit())}},{key:"setUser",value:function setUser(t,r,o){this.user={id:t,email:r,name:o},this.initEvent&&this.initEvent
Medium
Ai Review Evidence
The UMD bundle builds an initialization payload containing the page hostname and user ID, email, and name.
build/umd/widget-image-carousel.umd.min.jsView on unpkg · L22ch("".concat(this.url,"/log"),{method:"POST",headers:{"Content-Type":"application/json",authorization:"Bearer ".concat(this.jwt)},body:JSON.stringify(o)});case 13:if((a=l.sent).ok){l.next=19
Findings
7 Medium4 Low
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencebuild/umd/widget-image-carousel.umd.min.js
MediumAi Review Evidencebuild/umd/widget-image-carousel.umd.min.js
MediumAi Review Evidencebuild/umd/widget-image-carousel.umd.min.js
MediumAi Review Evidencebuild/umd/widget-image-carousel.umd.min.js
MediumAi Review Evidencepackage.json
LowScripts Present
LowEvalbuild/umd/widget-image-carousel.umd.min.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @crystaldesign/widget-image-carousel@26.13.0.
See all versions of @crystaldesign/widget-image-carousel for other recorded verdicts.
- Review the evidence and your use of @crystaldesign/widget-image-carousel@26.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.