registry / @goldlabelapps/notify / 3.9.3
@goldlabelapps/notify@3.9.3
Unified pings, device fingerprinting, emails, and real-time messaging SDK for Goldlabel applications.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe flagged network and environment access supports the package’s browser telemetry feature, and the API key is supplied by the caller for that service. No install-time behavior or concrete attack was found in the inspected source.
Static reason
One or more suspicious static signals were detected.
Trigger
An application calls the exported ping or fingerprint APIs, or uses the React ping component.
Impact
These calls disclose telemetry to the configured notification service and limited usage statistics to FingerprintJS; the inspected source did not show credential harvesting or a separate attack behavior.
Mechanism
The ping API requires a caller-provided API key, collects browser, device, fingerprint, and page metadata, and posts it to the configured endpoint, defaulting to private.goldlabel.pro. FingerprintJS also sends an unpersonalized monitoring request on a 0.1% sample when its agent loads.
AI rationale
The flagged network and environment access supports the package’s browser telemetry feature, and the API key is supplied by the caller for that service. No install-time behavior or concrete attack was found in the inspected source.
Network endpoints2
private.goldlabel.pro/api/notify/pingm1.openfpcdn.io/fingerprintjs/v${version}/npm-monitoring
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no install lifecycle hooks; it depends on FingerprintJS and UAParser for its advertised device telemetry functionality.
- The exported browser ping API requires a caller-supplied API key, gathers device and page telemetry, and posts it to the default notify endpoint at private.goldlabel.pro.
- FingerprintJS monitoring is part of its fingerprint agent and sends an unpersonalized statistics request only on a 0.1% sample; UAParser supplies browser and device parsing.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/constants.jsView file
9patternName = google_api_key
severity = high
line = 9
High
9patternName = google_api_key
severity = high
line = 9
High
3export const DEFAULT_PING_ENDPOINT = `${DEFAULT_NOTIFY_API_BASE_URL}/notify/ping`;
export const LOCAL_DEV_PING_ENDPOINT = `${LOCAL_DEV_NOTIFY_API_BASE_URL}/notify/ping`;
export con
Low
Ai Review Evidence
The exported browser ping API requires a caller-supplied API key, gathers device and page telemetry, and posts it to the default notify endpoint at private.goldlabel.pro.
dist/constants.jsView on unpkg · L3dist/constants.d.ts
Findings
3 High2 Medium7 Low
HighHigh Secretdist/constants.js
HighSecret Patterndist/constants.js
HighSecret Patterndist/constants.d.ts
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/constants.js
Affected versions and remediation
This report applies to @goldlabelapps/notify@3.9.3.
See all versions of @goldlabelapps/notify for other recorded verdicts.
- Review the evidence and your use of @goldlabelapps/notify@3.9.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.