@forjacms/sections@2.1.6
Framework-agnostic Web Components for rendering Forja page sections. Zero CSS — bring your own styles via BEM class hooks.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the reviewed runtime behavior matches a browser component library with consumer-configured form handling. The suspicious network and cookie strings resolve to sanitizer test inputs, while the dynamic requires inspected are local bundle imports.
Decision evidence
public snapshot- package.json lists build, development, and test scripts; no preinstall, install, or postinstall hook is present.
- The exported loader initializes the package's browser components and returns without initializing when no browser window exists.
- Contact form submissions emit FormData as a component event; the form action is supplied through the formAction property.
- The cookie and evil.example strings appear in sanitizer test input, whose assertions check that event handlers and cookie references are removed.
Source & flagged code
4 flagged · loading sourcePackage source references dynamic require/import behavior.
dist/index.cjs.jsView on unpkg · L1package.json lists build, development, and test scripts; no preinstall, install, or postinstall hook is present.
package.jsonView on unpkg · L32The exported loader initializes the package's browser components and returns without initializing when no browser window exists.
Findings
Affected versions and remediation
This report applies to @forjacms/sections@2.1.6.
See all versions of @forjacms/sections for other recorded verdicts.
- Review the evidence and your use of @forjacms/sections@2.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.