@infineon/design-system-vue@42.0.6
Vue wrapper for Infineon Design System Web Components
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s purpose and entry points are consistent with a Vue design-system wrapper, and there is no install-time attack behavior. Its components nevertheless send undisclosed, default runtime usage telemetry to an Infineon endpoint, so this merits a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
A component is loaded in a browser outside the skipped environments.
Impact
Infineon receives component and framework usage information without an evident consent check or opt-out in this flow.
Mechanism
The component calls trackComponent, which injects the tracker script and queues a component_initialized event containing the component name and detected framework.
AI rationale
The package’s purpose and entry points are consistent with a Vue design-system wrapper, and there is no install-time attack behavior. Its components nevertheless send undisclosed, default runtime usage telemetry to an Infineon endpoint, so this merits a warning rather than a malicious verdict.
Evidence
.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/tracking-DNHOWgWh.js.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/ifx-accordion.entry.js
Network endpoints1
ssgtm.infineon.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- When a component loads in the browser, it calls trackComponent with its component name and detected framework.
- The tracker defaults to https://ssgtm.infineon.com and loads its btnt.js script.
- The tracker queues a component_initialized event with the component name and framework; no user consent check or opt-out is shown in this flow.
Evidence against
- The package manifest has build and development scripts, but no install lifecycle hook.
- The entry point re-exports the Vue plugin and generated components, and the plugin registers custom elements, consistent with the package’s UI-library purpose.
Behavioral surface
Source & flagged code
4 flagged.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/ifx-accordion.entry.jsView file
13lapse = false;
async componentDidLoad() {
if (!isNestedInIfxComponent(this.el)) {
const framework = detectFramework();
trackComponent("ifx-accordion", await framework);
}
}
async onItemOpen(event) {
if (this.autoCollapse) {
const items = Array.from(this.el.querySelectorAll("ifx-accordion-item"));
for (const item of items) {
const itemElement = item;
if (itemElement !== event.target
Medium
Ai Review Evidence
When a component loads in the browser, it calls trackComponent with its component name and detected framework.
.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/ifx-accordion.entry.jsView on unpkg · L13.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/tracking-DNHOWgWh.jsView file
Findings
4 Medium1 Low
MediumAi Review Evidence.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/ifx-accordion.entry.js
MediumAi Review Evidence.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/tracking-DNHOWgWh.js
MediumAi Review Evidence.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/tracking-DNHOWgWh.js
MediumAi Review Evidence.lpm-dependency-evidence-164e6344-b254-41d2-8e6c-dbfde8459baa/0/npm-linux/dist/esm/tracking-DNHOWgWh.js
LowScripts Present
Affected versions and remediation
This report applies to @infineon/design-system-vue@42.0.6.
See all versions of @infineon/design-system-vue for other recorded verdicts.
- Review the evidence and your use of @infineon/design-system-vue@42.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.