registry / Telemetry / @finos/legend-application-marketplace / 0.4.6

@finos/legend-application-marketplace@0.4.6

Legend Marketplace application core

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The package has no install-time attack behavior, and the flagged CSS appears to contain only a BOM before normal styles. However, runtime telemetry includes user-entered business text and identifiable contract details, which warrants a warning because this package shows no disclosure or opt-out for those fields.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

When users search, submit an order, or act on data contracts in the application.

Impact

Business-sensitive text and identity or workflow metadata may be recorded without disclosure or an opt-out evident in this package.

Mechanism

Telemetry helpers pass search queries, order business reasons, and contract consumer/requester identifiers to an injected telemetryService.logEvent. The destination is not defined in this package.

AI rationale

Evidence

lib/__lib__/LegendMarketplaceTelemetryHelper.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Search events pass the raw query to the injected telemetry service.
Order submission telemetry includes the user-provided businessReason.
Contract action telemetry includes consumer, requester, and workflow identifiers.
The package exports application modules; the inspected scripts are build and development tasks.

Evidence against

The package has no install lifecycle hook in its metadata.
The telemetry destination is supplied by the host application; no unrelated collector or credential flow was identified.
The CSS flag appears to be a BOM before ordinary CSS rules.

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 290 file(s), 2.40 MB of source, external domains: example-website.com, example.com, test-dev-ingest-server.com, test-prod-ingest-server.com, test-prod-parallel-ingest-server.com

Source & flagged code

7 flagged

lib/index.cssView file

17contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>.MuiDialogTitle-root{font-size:2rem}.MuiButton-root,.MuiInputBase-root,.MuiFormLabel-root,.MuiFormControlLabel-label,.MuiMenuItem-root,.MuiSnackbarContent-root,.MuiStepLabel-label,.MuiTooltip-tooltip{font-size:1.2rem}:root{--legend-

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/index.cssView on unpkg · L17

•Trigger-reachable chain: manifest.exports -> lib/index.css Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/index.cssView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

2 Critical1 High6 Medium3 Low

CriticalTrojan Source Unicodelib/index.css

CriticalTrigger Reachable Dangerous Capabilitylib/index.css

HighSemantic Analysis Limitedlib/index.css

MediumNetwork

MediumStructural Risk Force Deep Review

MediumAi Review Evidencelib/__lib__/LegendMarketplaceTelemetryHelper.js

MediumAi Review Evidencepackage.json

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @finos/legend-application-marketplace@0.4.6.

See all versions of @finos/legend-application-marketplace for other recorded verdicts.

Review the evidence and your use of @finos/legend-application-marketplace@0.4.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 17:58:51.586Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / @finos/legend-application-marketplace / 0.4.6

@finos/legend-application-marketplace@0.4.6

Legend Marketplace application core

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

When users search, submit an order, or act on data contracts in the application.

Impact

Business-sensitive text and identity or workflow metadata may be recorded without disclosure or an opt-out evident in this package.

Mechanism

Telemetry helpers pass search queries, order business reasons, and contract consumer/requester identifiers to an injected telemetryService.logEvent. The destination is not defined in this package.

AI rationale

Evidence

lib/__lib__/LegendMarketplaceTelemetryHelper.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Search events pass the raw query to the injected telemetry service.
Order submission telemetry includes the user-provided businessReason.
Contract action telemetry includes consumer, requester, and workflow identifiers.
The package exports application modules; the inspected scripts are build and development tasks.

Evidence against

The package has no install lifecycle hook in its metadata.
The telemetry destination is supplied by the host application; no unrelated collector or credential flow was identified.
The CSS flag appears to be a BOM before ordinary CSS rules.

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 290 file(s), 2.40 MB of source, external domains: example-website.com, example.com, test-dev-ingest-server.com, test-prod-ingest-server.com, test-prod-parallel-ingest-server.com

Source & flagged code

7 flagged

lib/index.cssView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/index.cssView on unpkg · L17

•Trigger-reachable chain: manifest.exports -> lib/index.css Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/index.cssView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

2 Critical1 High6 Medium3 Low

CriticalTrojan Source Unicodelib/index.css

CriticalTrigger Reachable Dangerous Capabilitylib/index.css

HighSemantic Analysis Limitedlib/index.css

MediumNetwork

MediumStructural Risk Force Deep Review

MediumAi Review Evidencelib/__lib__/LegendMarketplaceTelemetryHelper.js

MediumAi Review Evidencepackage.json

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @finos/legend-application-marketplace@0.4.6.

See all versions of @finos/legend-application-marketplace for other recorded verdicts.

Review the evidence and your use of @finos/legend-application-marketplace@0.4.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 17:58:51.586Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface