@elliemae/ssf-guest@2.35.2
ICE MT SSF Guest Library
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package’s guest and host messaging behavior fits its stated purpose, and I found no install-time attack or credential theft. However, instance creation enables runtime diagnostics that include page identifiers and are sent to a remote endpoint without an apparent opt-in, so this warrants a warning.
Static reason
No blocking static signals were detected.
Trigger
Application code constructs SSFGuest.
Impact
The service can receive page URLs, paths, titles, application identifiers, metrics, and error details without a separate telemetry opt-in.
Mechanism
The constructor registers web-vitals and error reporting and logs the page URL; the default HTTP transport posts logs to the ICE diagnostics service.
AI rationale
The package’s guest and host messaging behavior fits its stated purpose, and I found no install-time attack or credential theft. However, instance creation enables runtime diagnostics that include page identifiers and are sent to a remote endpoint without an apparent opt-in, so this warrants a warning.
Evidence
dist/cjs/guest.js.lpm-dependency-evidence-3ef88294-906c-40ae-96a5-fa240146fa6f/0/npm-linux/dist/cjs/webvitals.js.lpm-dependency-evidence-3ef88294-906c-40ae-96a5-fa240146fa6f/0/npm-linux/dist/cjs/diagnosticsEndpoint.js.lpm-dependency-evidence-3ef88294-906c-40ae-96a5-fa240146fa6f/0/npm-linux/dist/cjs/transport/http.js
Network endpoints1
api.mortgagetech.ice.com/diagnostics/v2/logging
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Constructing SSFGuest automatically registers web-vitals reporting and logs the current page URL.
- Web-vitals reports include product and app URLs, paths, page titles, and application IDs.
- The diagnostics logger sends log bodies by POST to the default ICE diagnostics endpoint.
Evidence against
- The package is a browser guest library, and its host communication and session keep-alive behavior fit that purpose.
- No install lifecycle hook or automatic credential collection was identified.
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/umd/e2e-guest.js.gzView file
•path = dist/umd/e2e-guest.js.gz
kind = compressed_blob
sizeBytes = 2087
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/umd/e2e-guest.js.gzView on unpkgdist/umd/index.js.brView file
•path = dist/umd/index.js.br
kind = high_entropy_blob
sizeBytes = 7661
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/umd/index.js.brView on unpkgdist/cjs/guest.jsView file
175logger: this.#logger,
enabled: options?.auditOperations,
throttleMs: options?.auditThrottleMs
});
(0, import_pui_diagnostics.webvitals)(this.#logger);
(0, import_pui_
Findings
1 High7 Medium4 Low
HighShips High Entropy Blobdist/umd/index.js.br
MediumNetwork
MediumShips Compressed Blobdist/umd/e2e-guest.js.gz
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/cjs/guest.js
MediumAi Review Evidencedist/cjs/guest.js
MediumAi Review Evidence.lpm-dependency-evidence-3ef88294-906c-40ae-96a5-fa240146fa6f/0/npm-linux/dist/cjs/webvitals.js
MediumAi Review Evidence.lpm-dependency-evidence-3ef88294-906c-40ae-96a5-fa240146fa6f/0/npm-linux/dist/cjs/diagnosticsEndpoint.js
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @elliemae/ssf-guest@2.35.2.
See all versions of @elliemae/ssf-guest for other recorded verdicts.
- Review the evidence and your use of @elliemae/ssf-guest@2.35.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.