@mapvx/web-components-ssr@1.11.0
A modern, framework-agnostic web component built with Angular 22 that provides an interactive map and location discovery interface.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe browser component configures Sentry to report runtime exceptions to a hard-coded publisher endpoint, and its README does not disclose that reporting or provide an opt-out. This supports a suspicious telemetry verdict, but the inspected source does not establish credential theft or another malicious payload.
Decision evidence
public snapshot- The production Sentry configuration uses a hard-coded DSN on sentry.mapvx.app.
- The runtime logger initializes Sentry by default outside debug mode.
- The package's Angular error handler forwards caught exceptions to Sentry.
- The package manifest points its main entry to dist/browser/main.js.
- The README describes a browser map and location discovery component, consistent with its Mapvx API traffic.
- The manifest has a prepare script but no preinstall, install, or postinstall script.
Source & flagged code
3 flaggedSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/browser/chunk-D6zG2upO.jsView on unpkg · L2A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/browser/main.jsView on unpkgFindings
Affected versions and remediation
This report applies to @mapvx/web-components-ssr@1.11.0.
See all versions of @mapvx/web-components-ssr for other recorded verdicts.
- Review the evidence and your use of @mapvx/web-components-ssr@1.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.