registry / @elliemae/ssf-guest / 2.28.8
@elliemae/ssf-guest@2.28.8
ICE MT SSF Guest Library
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection shows a browser-side SSF guest library, not an install-time or host-compromise payload. Network use is limited to configured ICE/Ellie Mae diagnostics and host-supplied OAuth token lifecycle endpoints.
Static reason
No blocking static signals were detected.
Trigger
Importing the library in a browser and constructing/connecting SSFGuest; token revocation occurs on close.
Impact
No install-time execution, persistence, local file or credential harvesting, shell execution, or remote payload loading was found.
Mechanism
Origin-bound postMessage remoting plus configured diagnostics/OAuth requests.
AI rationale
Source inspection shows a browser-side SSF guest library, not an install-time or host-compromise payload. Network use is limited to configured ICE/Ellie Mae diagnostics and host-supplied OAuth token lifecycle endpoints.
Evidence
package.jsondist/cjs/index.jsdist/cjs/guest.jsdist/cjs/utils.jsdist/cjs/v1-adapter.jsdist/cjs/app.config.jsonREADME.mddist/public/e2e-guest.jsdist/umd/index.jsdist/umd/index.js.gzdist/umd/index.js.br
Network endpoints5
api.elliemae.com/diagnostics/v2/loggingstg.api.elliemae.com/diagnostics/v2/loggingconcept.api.elliemae.com/diagnostics/v2/loggingpel1.api.ellielabs.com/diagnostics/v2/loggingint.api.ellielabs.com/diagnostics/v2/logging
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hooks.
- dist/cjs/index.js only exports SSFGuest from ./guest.js.
- dist/cjs/guest.js uses browser iframe remoting with explicit target origins.
- dist/cjs/guest.js diagnostics endpoints are Elliemae/ICE domains.
- No child-process, eval/vm, filesystem, env-harvesting, or AI-agent-control references found in JavaScript sources.
- Compressed .gz/.br files accompany readable JS bundle artifacts, not opaque executable loaders.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
2 flaggeddist/umd/e2e-guest.js.gzView file
•path = dist/umd/e2e-guest.js.gz
kind = compressed_blob
sizeBytes = 2087
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/umd/e2e-guest.js.gzView on unpkgdist/umd/index.js.brView file
•path = dist/umd/index.js.br
kind = high_entropy_blob
sizeBytes = 7719
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/umd/index.js.brView on unpkgFindings
1 High3 Medium3 Low
HighShips High Entropy Blobdist/umd/index.js.br
MediumNetwork
MediumShips Compressed Blobdist/umd/e2e-guest.js.gz
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @elliemae/ssf-guest@2.28.8.
See all versions of @elliemae/ssf-guest for other recorded verdicts.
- Review the evidence and your use of @elliemae/ssf-guest@2.28.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.