@fintech-automation/face-liveness@0.3.4
This package has been renamed to @fintech-automation/identity-verification. Please install @fintech-automation/identity-verification instead.
Branded, drop-in face liveness React component with runtime configuration built in.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package automatically reports the embedding page origin with session details to its own service, which qualifies as undisclosed runtime telemetry carrying identifying information. The verification token is otherwise used for the package's intended face-liveness API flow, so this supports a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A liveness session is successfully created during the component flow.
Impact
The service receives the embedding site's origin alongside session data without a separate telemetry consent step.
Mechanism
The package posts a tracking payload containing the supplied state token, session identifier, timestamp, and window.location.origin to its configured backend.
AI rationale
The package automatically reports the embedding page origin with session details to its own service, which qualifies as undisclosed runtime telemetry carrying identifying information. The verification token is otherwise used for the package's intended face-liveness API flow, so this supports a warning rather than a malicious verdict.
Evidence
dist/index.cjs
Network endpoints5
api.accelerationcloud.com/api/v1/cores/{tenant}/facial-liveness/sessionsapi.accelerationcloud.com/api/v1/public/iframe/trackapi-dev.accelerationcloud.infoapi-staging.accelerationcloud.infoapi-uat.accelerationcloud.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest describes a drop-in face-liveness React component.
- The component sends its caller-supplied verification token as a bearer token to the configured face-liveness API.
- After a session is created, the code automatically invokes a separate tracking function.
- That tracking payload includes the state token, session ID, timestamp, and embedding page origin; the origin is identifying runtime telemetry.
- The production API host is api.accelerationcloud.com, consistent with the package's verification service.
- The lifecycle scripts are husky setup and a prepublish build; no install-time data collection is shown.
Evidence against
- The token is explicitly supplied to the face-liveness component and used for its verification API.
- No browser credential harvesting or unrelated credential exfiltration was established from the inspected package-specific code.
- The tracking request goes to the configured verification backend and is associated with creating a liveness session.
Behavioral surface
EnvironmentVars
Source & flagged code
5 flaggeddist/index.cjsView file
8patternName = generic_password
severity = medium
line = 8
Medium
dist/face-liveness.min.jsView file
1"use strict";var FaceLiveness=(()=>{var fRt=Object.create;var AT=Object.defineProperty;var mRt=Object.getOwnPropertyDescriptor;var gRt=Object.getOwnPropertyNames;var hRt=Object.get...
L2: Event: `).concat(JSON.stringify(p.data))),n.state;if(n.status!==Sn.Running&&!n.options.deferEvents)throw new Error('Event "'.concat(p.name,'" was sent to uninitialized service "')....
...
L5: `).concat(w.message))}if(y&&h){p.target!==void 0&&(u=p.target),a.push.apply(a,Zr([],ir(p.actions),!1)),l=p;break}}}catch(w){n={error:w}}finally{try{d&&!d.done&&(o=c.return)&&o.call...
L6: `).concat(a.message))}else return r.getStateNodeByPath(i)})},e.prototype.formatTransition=function(t){var r=this,n=jEe(t.target),o="internal"in t?t.internal:n?n.some(function(u){re...
L7: `+IZ+e}var AZ=!1;function TZ(e,t){if(!e|
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/face-liveness.min.jsView on unpkg · L1Findings
2 Critical1 High5 Medium4 Low
CriticalBrowser Credential Phishingdist/face-liveness.min.js
CriticalTrigger Reachable Dangerous Capabilitydist/face-liveness.min.js
HighSemantic Analysis Limiteddist/face-liveness.min.css
MediumSecret Patterndist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @fintech-automation/face-liveness@0.3.4.
See all versions of @fintech-automation/face-liveness for other recorded verdicts.
- Review the evidence and your use of @fintech-automation/face-liveness@0.3.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.