@graphysdk/react@1.9.0-beta.1793615827091
Graphy charting SDK for React
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package sends runtime telemetry to its own Sentry endpoint by default and includes the browser page hostname, an identifying detail not disclosed by its notice. The payload otherwise appears to contain aggregate chart metadata, and telemetry can be disabled, so this is suspicious rather than malicious.
Static reason
No blocking static signals were detected.
Trigger
By default when GraphProvider is used in a production browser and its chart scene becomes available; telemetry={false} disables it.
Impact
The page hostname is identifying information sent without being mentioned in the telemetry notice, so the runtime behavior is suspicious telemetry.
Mechanism
The component derives a chart shape, attaches window.location.hostname, and POSTs the event to the configured Sentry envelope endpoint.
AI rationale
The package sends runtime telemetry to its own Sentry endpoint by default and includes the browser page hostname, an identifying detail not disclosed by its notice. The payload otherwise appears to contain aggregate chart metadata, and telemetry can be disabled, so this is suspicious rather than malicious.
Evidence
dist/index.mjs.lpm-dependency-evidence-e93d2a90-7316-4809-9a1d-034b86c86415/1/npm-linux/dist/index.mjs
Network endpoints1
o4505108638597120.ingest.us.sentry.io
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- In production browser use, GraphProvider enables telemetry by default and sends one event after a scene becomes available unless telemetry={false}.
- The event includes the page hostname as a Sentry tag, which is identifying telemetry.
- The chart payload is derived from aggregate chart structure and counts; it does not appear to include raw chart values or labels.
- The package describes the telemetry and provides a telemetry={false} opt-out, but its notice does not disclose hostname collection.
Evidence against
- The telemetry goes to the package’s configured Sentry endpoint and uses a random event ID.
- No install lifecycle scripts are declared for this package.
- The inspected telemetry shape contains chart counts, types, and feature flags rather than raw chart data.
Behavioral surface
EnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/editable.browser.mjsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/editable.browser.mjsView on unpkgdist/index.mjsView file
75"function") {
e(t);
return;
}
e && (e.current = t);
};
function C(e, t) {
const r = f(null), n = f(!1), o = t !== !1, a = y(), c = process.env.NODE_ENV, i = typeof window < "u", s = o && w(c, i, a);
G(() => {
if (!o || (c === "development" && i && N(), !s)) return;
const d = r.current;
if (!d) return;
const u = () => {
try {
if (n.current) return;
const p = d.getScene();
Medium
Ai Review Evidence
In production browser use, GraphProvider enables telemetry by default and sends one event after a scene becomes available unless telemetry={false}.
dist/index.mjsView on unpkg · L75Findings
1 High4 Medium7 Low
HighSemantic Analysis Limiteddist/editable.browser.mjs
MediumEnvironment Vars
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidence.lpm-dependency-evidence-e93d2a90-7316-4809-9a1d-034b86c86415/1/npm-linux/dist/index.mjs
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @graphysdk/react@1.9.0-beta.1793615827091.
See all versions of @graphysdk/react for other recorded verdicts.
- Review the evidence and your use of @graphysdk/react@1.9.0-beta.1793615827091 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.