registry / @hubsync/esign-web-sdk / 6.9.49

@hubsync/esign-web-sdk@6.9.49

Verdocs Web SDK

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Stencil web SDK whose runtime network activity is aligned with Verdocs e-signature functionality.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing or using the web components in a browser application

Impact

Expected document signing, template, envelope, auth, and download workflows; no source-confirmed credential harvesting or exfiltration.

Mechanism

User-invoked e-signing UI with package-aligned API calls

Rationale

Static inspection found expected browser SDK behavior and package-aligned Verdocs API usage, with no install-time execution or concrete malicious chain. The noisy tampering/network findings are explained by bundled browser/polyfill and UI code.

Evidence

package.jsondist/index.cjs.jsdist/index.jsdist/esm/verdocs-web-sdk.jsdist/cjs/verdocs-web-sdk.cjs.jsdist/collection/utils/Environment.jsdist/collection/utils/Datastore.jsdist/collection/components/embeds/verdocs-sign/verdocs-sign.js

Network endpoints5

api.verdocs.comstage-api.verdocs.combeta.verdocs.comstage.verdocs.comfonts.gstatic.com

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

Runtime web components call Verdocs APIs and use browser storage for signing state in dist/collection/components/embeds/verdocs-sign/verdocs-sign.js
Browser bundle loads a Google font for signature rendering in dialog components

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks
dist/index.cjs.js and dist/index.js only forward to built Stencil entrypoints
dist/collection/utils/Environment.js selects package-aligned https://api.verdocs.com or https://stage-api.verdocs.com endpoints
Network/storage usage is tied to e-signing UI flows, downloads, templates, envelopes, signatures, and auth
No child_process, filesystem writes, persistence, destructive behavior, or AI-agent control-surface mutation found
Scanner API-tampering hint matches bundled Stencil/core-js/browser polyfill code, not exfiltration logic

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 578 file(s), 13.4 MB of source, external domains: api.verdocs.com, app.verdocs.com, beta.verdocs.com, chat.stenciljs.com, date-fns.org, developer.mozilla.org, en.wikipedia.org, fonts.gstatic.com, github.com, polymer.github.io, stage-api.verdocs.com, stage.verdocs.com, stenciljs.com, unleash.verdocs.com, verdocs.com, www.google.com, www.unicode.org, www.w3.org

Source & flagged code

2 flagged

dist/index.cjs.jsView file

Lines 1-2javascript

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

Lines 1-30javascript

2'use strict';

3(function () {

4 var currentScript = document.currentScript;

6 // Safari 10 support type="module" but still download and executes the nomodule script

7 if (!currentScript || !currentScript.hasAttribute('nomodule') || !('onbeforeload' in currentScript)) {

9 /**

10 * core-js 3.6.5

11 * https://github.com/zloirock/core-js

12 * License: http://rock.mit-license.org

14 */

15!function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.exports}e.m=t,e.c=n,e.d=function(t,n

17//!fetch 3.0.0, global "this" must be replaced with "window"

18// IIFE version

19!function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){return!1}}(),n="FormData"in self,i="ArrayBuffer"

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

21(function(){

22 /*

24 This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt

25 The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt

26 The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt

27 Code distributed by Google as part of the polymer project is also

28 subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt

29 */

30 'use strict';var aa=new Set("annotation-xml color-profile font-face font-face-src font-face-uri font-face-format font-face-name missing-glyph".split(" "));function g(a){var b=aa.has(a);a=/^[a-z][.0-9_a-z]*-[\-.0-9_a-z]*$/.test(a);return!b&&a}function l(a){

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

Findings

1 Critical4 Medium4 Low

CriticalBuiltin Api Tampering Exfiltrationdist/verdocs-web-sdk/verdocs-web-sdk.js

MediumDynamic Requiredist/index.cjs.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.cjs.jsView file

Lines 1-2javascript

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1

dist/verdocs-web-sdk/verdocs-web-sdk.jsView file

Lines 1-30javascript

2'use strict';

3(function () {

4 var currentScript = document.currentScript;

6 // Safari 10 support type="module" but still download and executes the nomodule script

7 if (!currentScript || !currentScript.hasAttribute('nomodule') || !('onbeforeload' in currentScript)) {

9 /**

10 * core-js 3.6.5

11 * https://github.com/zloirock/core-js

12 * License: http://rock.mit-license.org

14 */

17//!fetch 3.0.0, global "this" must be replaced with "window"

18// IIFE version

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

21(function(){

22 /*

24 This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt

25 The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt

26 The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt

27 Code distributed by Google as part of the polymer project is also

28 subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt

29 */

Long lines were clipped for display.