@farming-labs/nuxt-theme@0.2.136
Nuxt/Vue UI components for @farming-labs/docs — layout, sidebar, TOC, search, and theme toggle
AI Security Review
scanned 2d ago · by lpm-firewall-aiProduction page-view telemetry automatically sends the documentation site origin and pathname to the vendor, while the dependency’s type documentation says maintainer telemetry avoids page views. The opt-out and omission of visitor identifiers limit the risk, but the undisclosed page-view details warrant a warning.
Static reason
No blocking static signals were detected.
Trigger
When DocsLayout renders in a browser and on route changes, with telemetry enabled by default in production.
Impact
The vendor can associate public site origins and visited documentation paths with page-view events; the type documentation conflicts with the implementation by saying telemetry avoids page views.
Mechanism
The component calls the telemetry emitter, which posts a page-view event to the configured endpoint, defaulting to https://docs.farming-labs.dev/api/telemetry/events.
AI rationale
Production page-view telemetry automatically sends the documentation site origin and pathname to the vendor, while the dependency’s type documentation says maintainer telemetry avoids page views. The opt-out and omission of visitor identifiers limit the risk, but the undisclosed page-view details warrant a warning.
Evidence
src/components/DocsLayout.vue.lpm-dependency-evidence-8cf8bafb-ffaf-41ee-acd4-731ac9011c34/1/npm-linux/dist/telemetry-runtime.mjs.lpm-dependency-evidence-8cf8bafb-ffaf-41ee-acd4-731ac9011c34/1/npm-linux/dist/types.d.mts
Network endpoints1
docs.farming-labs.dev/api/telemetry/events
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- DocsLayout emits a page-view event on initial render and route changes, including the site origin, path, and locale.
- Telemetry is enabled by default in production, though users can disable it through config or environment variables.
- The telemetry runtime posts events to https://docs.farming-labs.dev/api/telemetry/events.
- The page-view payload includes the public site origin and pathname; package type documentation says maintainer telemetry avoids page views.
Evidence against
- The package declares no install, preinstall, or postinstall hook.
- The page-view code omits query strings, referrers, visitor IDs, IP addresses, and user agents.
- Telemetry has documented opt-outs, and the dependency describes it as production-only maintainer telemetry.
Behavioral surface
HighEntropyStringsPossibleObfuscation
Source & flagged code
7 flaggedsrc/components/ApiReferenceSwitcher.vueView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/components/ApiReferenceSwitcher.vueView on unpkgsrc/components/DocsLayout.vueView file
33watch(
() => route.fullPath,
() => {
if (typeof window === "undefined") return;
const locale =
(route.query.lang as string | undefined) ??
(route.query.locale as string | undefined) ??
undefined;
const pageKey = `${route.path}|${locale ?? ""}`;
if (pageKey === lastTelemetryPageKey) return;
lastTelemetryPageKey = pageKey;
emitDocsTelemetryPageViewEvent(props.config?.telemetry, {
framework: "nuxt",
siteOrigin
Medium
Ai Review Evidence
DocsLayout emits a page-view event on initial render and route changes, including the site origin, path, and locale.
src/components/DocsLayout.vueView on unpkg · L33Findings
1 High6 Medium2 Low
HighSemantic Analysis Limitedsrc/components/ApiReferenceSwitcher.vue
MediumAi Review Evidencesrc/components/DocsLayout.vue
MediumAi Review Evidence.lpm-dependency-evidence-8cf8bafb-ffaf-41ee-acd4-731ac9011c34/1/npm-linux/dist/telemetry-runtime.mjs
MediumAi Review Evidence.lpm-dependency-evidence-8cf8bafb-ffaf-41ee-acd4-731ac9011c34/1/npm-linux/dist/telemetry-runtime.mjs
MediumAi Review Evidence.lpm-dependency-evidence-8cf8bafb-ffaf-41ee-acd4-731ac9011c34/1/npm-linux/dist/telemetry-runtime.mjs
MediumAi Review Evidence.lpm-dependency-evidence-8cf8bafb-ffaf-41ee-acd4-731ac9011c34/1/npm-linux/dist/types.d.mts
MediumAi Review Evidence.lpm-dependency-evidence-8cf8bafb-ffaf-41ee-acd4-731ac9011c34/1/npm-linux/dist/telemetry-runtime.mjs
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @farming-labs/nuxt-theme@0.2.136.
See all versions of @farming-labs/nuxt-theme for other recorded verdicts.
- Review the evidence and your use of @farming-labs/nuxt-theme@0.2.136 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.