registry / @hubsync/esign-web-sdk / 6.9.45

@hubsync/esign-web-sdk@6.9.45

Verdocs Web SDK

AI Security Review

scanned 16d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime behavior is a Stencil browser component SDK for Verdocs e-sign workflows, with user/session-driven API calls to package-aligned Verdocs endpoints.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing/using web components such as verdocs-sign, verdocs-auth, or defineCustomElements in a browser app.

Impact

Expected e-signature workflow actions; no unconsented install-time execution or source-grounded exfiltration found.

Mechanism

browser UI components and Verdocs API client calls

Rationale

Static inspection shows expected bundled Stencil/browser SDK code and Verdocs-aligned network behavior, with no lifecycle execution, filesystem access, shell execution, credential harvesting, or external exfiltration path. The scanner's high-risk labels are explained by browser polyfills, component loaders, and normal e-sign workflow API calls.

Evidence

package.jsondist/index.cjs.jsdist/index.jsdist/cjs/index.cjs.jsdist/cjs/loader.cjs.jsdist/cjs/Environment-3vWt0C1Q.jsdist/components/verdocs-sign.jsdist/verdocs-web-sdk/verdocs-web-sdk.js

Network endpoints5

api.verdocs.comstage-api.verdocs.comunleash.verdocs.com/api/frontendverdocs.com/assets/white-logo.svgfonts.gstatic.com/s/dancingscript/v19/If2cXTr6YS-zF4S-kcSWSVi_sxjsohD9F50Ruu7BMSo3Sup6hNX6plRP.woff

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Browser SDK performs user-invoked network/API calls via @verdocs/js-sdk components.
dist/verdocs-web-sdk/verdocs-web-sdk.js includes fetch/SystemJS/custom-elements polyfills that patch browser globals.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; main only re-exports dist/cjs/index.cjs.js.
dist/cjs/Environment-3vWt0C1Q.js sets Verdocs API hosts: https://api.verdocs.com and https://stage-api.verdocs.com.
dist/components/verdocs-sign.js stores only signing UI state in localStorage/sessionStorage and uploads signatures/initials through Verdocs SDK calls.
No child_process, fs file access, process.env harvesting, shell execution, or credential exfiltration found in non-map package code.
Scanner's builtin tampering signal matches standard fetch/customElements/SystemJS/polyfill code in the bundled browser loader.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 578 file(s), 13.4 MB of source, external domains: api.verdocs.com, app.verdocs.com, beta.verdocs.com, chat.stenciljs.com, date-fns.org, developer.mozilla.org, en.wikipedia.org, fonts.gstatic.com, github.com, polymer.github.io, stage-api.verdocs.com, stage.verdocs.com, stenciljs.com, unleash.verdocs.com, verdocs.com, www.google.com, www.unicode.org, www.w3.org

Source & flagged code

2 flagged

dist/index.cjs.jsView file

Lines 1-2javascript

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

Lines 1-30javascript

2'use strict';

3(function () {

4 var currentScript = document.currentScript;

6 // Safari 10 support type="module" but still download and executes the nomodule script

7 if (!currentScript || !currentScript.hasAttribute('nomodule') || !('onbeforeload' in currentScript)) {

9 /**

10 * core-js 3.6.5

11 * https://github.com/zloirock/core-js

12 * License: http://rock.mit-license.org

14 */

15!function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.exports}e.m=t,e.c=n,e.d=function(t,n

17//!fetch 3.0.0, global "this" must be replaced with "window"

18// IIFE version

19!function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){return!1}}(),n="FormData"in self,i="ArrayBuffer"

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

21(function(){

22 /*

24 This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt

25 The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt

26 The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt

27 Code distributed by Google as part of the polymer project is also

28 subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt

29 */

30 'use strict';var aa=new Set("annotation-xml color-profile font-face font-face-src font-face-uri font-face-format font-face-name missing-glyph".split(" "));function g(a){var b=aa.has(a);a=/^[a-z][.0-9_a-z]*-[\-.0-9_a-z]*$/.test(a);return!b&&a}function l(a){

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

Findings

1 Critical4 Medium4 Low

CriticalBuiltin Api Tampering Exfiltrationdist/verdocs-web-sdk/verdocs-web-sdk.js

MediumDynamic Requiredist/index.cjs.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.cjs.jsView file

Lines 1-2javascript

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

Lines 1-30javascript

2'use strict';

3(function () {

4 var currentScript = document.currentScript;

6 // Safari 10 support type="module" but still download and executes the nomodule script

7 if (!currentScript || !currentScript.hasAttribute('nomodule') || !('onbeforeload' in currentScript)) {

9 /**

10 * core-js 3.6.5

11 * https://github.com/zloirock/core-js

12 * License: http://rock.mit-license.org

14 */

17//!fetch 3.0.0, global "this" must be replaced with "window"

18// IIFE version

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

21(function(){

22 /*

24 This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt

25 The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt

26 The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt

27 Code distributed by Google as part of the polymer project is also

28 subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt

29 */

Long lines were clipped for display.