registry / Credential exfiltration / @mapvx/web-components-ssr

@mapvx/web-components-ssr

A modern, framework-agnostic web component built with Angular 22 that provides an interactive map and location discovery interface.

This report shows the evidence for @mapvx/web-components-ssr@1.10.0. 2 of 17 known versions are blocked or flagged. The newest version, 1.12.0, is flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package automatically sends its required MapVX API key as a parameter in Google Analytics events. This is credential exfiltration to a foreign service, so the version should be blocked.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The component initializes and starts its logging session; subsequent analytics events are also emitted during normal use.

Impact

A user's MapVX API key is disclosed to Google's analytics service without their consent.

Mechanism

The component stores its supplied API key in the logger, which adds it to event parameters sent through Google Analytics.

Attack narrative

On component startup, the logger starts a session. When the component receives the API key it needs to function, it stores the key in the logger. The logger adds that key to analytics event parameters sent to the package's fixed Google Analytics destination, exposing a MapVX credential to an unrelated service without consent.

AI rationale

The package automatically sends its required MapVX API key as a parameter in Google Analytics events. This is credential exfiltration to a foreign service, so the version should be blocked.

Evidence

dist/browser/main.jsREADME.md

Network endpoints1

www.googletagmanager.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The README says the component requires an API key.
When the component receives an API key, it initializes the SDK and stores that key in the logger.
Logger events include the API key and are forwarded to Google Analytics.
The component starts a logging session in its constructor, so this reporting begins automatically.
The bundle configures a fixed Google Analytics measurement ID and loads gtag.js from www.googletagmanager.com.

Evidence against

The package is an interactive map component, so using an API key and making requests to MapVX services fit its stated purpose.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 17 file(s), 5.01 MB of source, external domains: angular.dev, api.mapvx.com, archive.org, deck.gl, en.wikipedia.org, github.com, images.ctfassets.net, jcgt.org, maplibre.org, mapvx-glb-assets.s3.us-east-1.amazonaws.com, public-api.mapvx.com, raw.githubusercontent.com, rolldown.rs, sodipodi.sourceforge.net, unpkg.com, wiki.openstreetmap.org, www.google.com, www.googletagmanager.com, www.gstatic.com, www.inkscape.org, www.movable-type.co.uk, www.w3.org

Source & flagged code

3 flagged

dist/browser/chunk-D6zG2upO.jsView file

2contains invisible/control Unicode U+FEFF (zero width no-break space) `+e.extraStackTrace()),Xu(Z)}function bb(Z,ae,Te,re){Nn(`Assertion failed: `+le(Z)+`, at: `+[ae?le(ae):`unknown filename`,Te,re?le(re):`unknown function`])}function Ju(){return xe.length}function Tb(Z,ae,Te){Ne.set(Ne.subarray(ae,ae+Te),Z)}

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/browser/chunk-D6zG2upO.jsView on unpkg · L2

dist/browser/main.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/browser/main.jsView on unpkg

README.md

Findings

1 Critical2 High2 Medium7 Low

CriticalTrojan Source Unicodedist/browser/chunk-D6zG2upO.js

HighSemantic Analysis Limiteddist/browser/main.js

HighAi Review EvidenceREADME.md

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @mapvx/web-components-ssr@1.10.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @mapvx/web-components-ssr@1.10.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-31 02:38:09.038Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

17 known versions

1.12.0latestSuspiciousTelemetryWarnPublishedOct 30, 2026, 1:21 AM 1.11.0SuspiciousTelemetryWarnPublishedOct 30, 2026, 12:31 AM 1.10.0shownMaliciousCredential ExfiltrationBlockPublishedOct 29, 2026, 7:11 PM 1.9.0SuspiciousTelemetryWarnPublished

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages