registry / @forjacms/sections / 2.1.5

@forjacms/sections@2.1.5

Framework-agnostic Web Components for rendering Forja page sections. Zero CSS — bring your own styles via BEM class hooks.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The manifest contains no install lifecycle hooks, and the flagged signals resolve to bundled dependencies, component loading, sanitizer tests, and challenge-widget behavior. The inspected source supports a normal web-component package with no confirmed malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package exposes its components; contact-form challenge behavior activates when configured and used.

Impact

No credential theft, unrelated data transmission, or destructive behavior was established.

Mechanism

The inspected networking indicator is a challenge widget bound to a supplied endpoint, while form submission is gated on a solved token. The sanitizer applies an allowlist before returning HTML.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes component and loader entrypoints and lists build, development, and test scripts without install lifecycle hooks.
The sanitizer uses an allowlist and removes unsafe markup before returning HTML.
The contact form’s challenge widget is tied to a supplied challenge endpoint and submission waits for a solved token.

Evidence against

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

CopyleftLicense

scanned 162 file(s), 1.62 MB of source, external domains: chat.stenciljs.com, evil.example, evilmartians.com, example.com, github.com, stenciljs.com, www.w3.org, www.w3ctech.com

Source & flagged code

4 flagged

dist/index.cjs.jsView file

Lines 1-2javascript

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

package.jsonView file

Lines 1-52json

2 "name": "@forjacms/sections",

3 "version": "2.1.5",

4 "description": "Framework-agnostic Web Components for rendering Forja page sections. Zero CSS — bring your own styles via BEM class hooks.",

5 "author": "Dominik Dorfstetter <dominik@dorfstetter.at>",

6 "type": "module",

7 "main": "dist/index.cjs.js",

8 "module": "dist/index.js",

9 "types": "dist/types/index.d.ts",

10 "collection": "dist/collection/collection-manifest.json",

11 "collection:main": "dist/collection/index.js",

12 "exports": {

13 ".": {

14 "import": "./dist/index.js",

15 "require": "./dist/index.cjs.js",

16 "types": "./dist/types/index.d.ts"

17 },

18 "./loader": {

19 "import": "./loader/index.js",

20 "require": "./loader/index.cjs.js",

Low

Suspicious Lifecycle Evidence

The manifest exposes component and loader entrypoints and lists build, development, and test scripts without install lifecycle hooks.

package.jsonView on unpkg · L12

21 "types": "./loader/index.d.ts"

22 },

23 "./define": {

24 "import": "./dist/define-all.js",

25 "types": "./dist/define-all.d.ts"

26 }

27 },

28 "files": [

29 "dist/",

30 "loader/"

31 ],

32 "scripts": {

33 "build": "stencil build && node scripts/generate-define-all.js",

34 "dev": "stencil build --dev --watch",

35 "test": "stencil-test",

36 "test:watch": "stencil-test --watch",

Low

Suspicious Lifecycle Evidence

The manifest exposes component and loader entrypoints and lists build, development, and test scripts without install lifecycle hooks.

package.jsonView on unpkg · L32

37 "test:spec": "stencil-test --project spec",

38 "test:unit": "stencil-test --project unit"

39 },

40 "keywords": [

41 "web-components",

42 "stencil",

43 "sections",

44 "headless",

45 "cms",

46 "forja",

47 "accessible",

48 "custom-elements"

49 ],

50 "license": "AGPL-3.0-or-later",

51 "repository": {

52 "type": "git",

dist/collection/utils/sanitize.jsView file

Lines 1-27javascript

1import sanitizeHtmlLib from "sanitize-html";

2/**

3 * Allowlist mirrored from `templates/astro-blog/src/lib/markdown.ts` so the

4 * shipped components are safe-by-default rather than relying on every consumer

5 * to sanitize the pre-rendered HTML they bind to section props.

6 */

7const SANITIZE_CONFIG = {

Source & flagged code

4 flagged · loading source

dist/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

package.jsonView file

12"exports": { ".": { "import": "./dist/index.js", "require": "./dist/index.cjs.js", "types": "./dist/types/index.d.ts" }, "./loader": { "import": "./loader/index.js", "require":

Low

Suspicious Lifecycle Evidence

The manifest exposes component and loader entrypoints and lists build, development, and test scripts without install lifecycle hooks.

package.jsonView on unpkg · L12

32"scripts": { "build": "stencil build && node scripts/generate-define-all.js", "dev": "stencil build --dev --watch", "test": "stencil-test", "test:watch": "stencil-test --wa

Low

Suspicious Lifecycle Evidence

Findings

4 Medium8 Low

MediumDynamic Requiredist/index.cjs.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/collection/utils/sanitize.js

Affected versions and remediation

This report applies to @forjacms/sections@2.1.5.

See all versions of @forjacms/sections for other recorded verdicts.

Review the evidence and your use of @forjacms/sections@2.1.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 20:11:49.525Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @forjacms

Runtime surface

Behavioral surface

Related packages

More from @forjacms

Source & flagged code