@ethersphere/bee-dashboard@0.37.1
An app which helps users to setup their Bee node and do actions like cash out cheques
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe wallet transfer matches the dashboard’s gift-code funding flow and occurs through an explicit button. However, the app initializes Formbricks and sends a file-manager engagement event by default, with no opt-out visible in the inspected code, so this is suspicious runtime telemetry.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The app initializes Formbricks; after 25 clicks in the active file manager it sends an engagement event.
Impact
File-manager engagement is reported to the external survey service. The inspected code shows no opt-out.
Mechanism
The app configures the Formbricks SDK with a fixed environment ID and the app.formbricks.com endpoint, then tracks a fixed event.
AI rationale
The wallet transfer matches the dashboard’s gift-code funding flow and occurs through an explicit button. However, the app initializes Formbricks and sends a file-manager engagement event by default, with no opt-out visible in the inspected code, so this is suspicious runtime telemetry.
Evidence
lib/App-C6fpT-TP.mjs
Network endpoints1
app.formbricks.com/
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The app configures Formbricks at https://app.formbricks.com/ during runtime.
- After 25 clicks in the active file manager, the app sends a fixed engagement event through Formbricks; no opt-out is visible in the inspected code.
Evidence against
- The gift-wallet transfer uses a supplied private key and is tied to a button labeled to send funds to the displayed node wallet address.
- The package manifest declares no install, preinstall, or postinstall script.
- The inspected server entry serves the local build and opens localhost.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggedbuild/assets/index-DsAFV67X.jsView file
1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/download.node-CjooJ0wX.js","assets/vendor-react-mui-tUcmOwCz.js","assets/vendor-ethers-Dh545u0a.js","assets/downloa...
L2: import{r as x,j as c,p as O4,a as U0,m as Ke,L as cn,b as y7,T as Ne,E as pf,d as yf,C as b1,B as le,e as Wt,I as Sn,f as E1,G as Ve,u as xa,X as jt,h as db,M as xf,i as fb,k as F4...
L3: `).forEach(function(d){s=d.indexOf(":"),t=d.substring(0,s).trim().toLowerCase(),n=d.substring(s+1).trim(),!(!t||a[t]&&Th[t])&&(t==="set-cookie"?a[t]?a[t].push(n):a[t]=[n]:a[t]=a[t]...
...
L9: `,d+1),l=f===-1?"":i.slice(f+1);String(n.stack).endsWith(l)||(n.stack+=`
L10: `+i)}}catch{}}throw n}}_request(a,t){typeof a=="string"?(t=t||{},t.url=a):t=a||{},t=Gn(this.defaults,t);const{transitional:n,paramsSerializer:s,header
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
build/assets/index-DsAFV67X.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = @ethersphere/bee-dashboard@0.37.0
matchedIdentity = npm:[redacted]:0.37.0
similarity = 0.920
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
build/assets/index-DsAFV67X.jsView on unpkgFindings
2 Critical2 High5 Medium6 Low
CriticalWallet Drainbuild/assets/index-DsAFV67X.js
CriticalPrevious Version Dangerous Deltabuild/assets/index-DsAFV67X.js
HighEntrypoint Build Divergenceserve.js
HighSemantic Analysis Limitedlib/App-C6fpT-TP.mjs
MediumDynamic Requireserve.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filelib/App-C6fpT-TP.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalbuild/assets/index-DsAFV67X.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to @ethersphere/bee-dashboard@0.37.1.
See all versions of @ethersphere/bee-dashboard for other recorded verdicts.
- Review the evidence and your use of @ethersphere/bee-dashboard@0.37.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.