@csedigital/component-library@0.0.3
In progress amalgamation of existing component library versions and project components into a universal, sharable, themed set of components and blocks.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package performs runtime analytics on ticket-link clicks and includes event context, without documenting that tracking in its README. This is a warning-level telemetry concern; the inspected source shows no install-time or import-time data collection.
Decision evidence
public snapshot- The CTA component imports @vercel/analytics and tracks ticket clicks with the event name, schedule location, and game date.
- The README describes the component library but does not disclose analytics tracking.
- Tracking is attached to a ticket-link click; the inspected entry point only re-exports components and utilities.
- The manifest has no install lifecycle scripts. The flagged Root.css excerpt contains ordinary theme and layout styles.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/esm/components/Card/components/Root/Root.cssView on unpkgThe CTA component imports @vercel/analytics and tracks ticket clicks with the event name, schedule location, and game date.
dist/esm/components/GameCard/components/CTA/CTA.jsView on unpkg · L62Findings
Affected versions and remediation
This report applies to @csedigital/component-library@0.0.3.
See all versions of @csedigital/component-library for other recorded verdicts.
- Review the evidence and your use of @csedigital/component-library@0.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.