registry / Telemetry / @mapvx/web-components-ssr / 1.12.0

@mapvx/web-components-ssr@1.12.0

A modern, framework-agnostic web component built with Angular 22 that provides an interactive map and location discovery interface.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The scanner's Trojan Source flag is explained by a parser stripping a leading BOM, and I found no concrete credential theft or unrelated attack behavior. However, the entry point activates a fixed Google Analytics ID without a visible disclosure or opt-out, so the undisclosed runtime telemetry warrants a warning.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading the browser entry point bootstraps the custom element and configures Google Analytics; Sentry reporting is initialized when errors are reported.

Impact

Visitor and application activity may be reported to Google, and error details may be sent to Mapvx, without a visible disclosure or opt-out in the inspected package files.

Mechanism

A hard-coded Google Analytics measurement ID is passed to the analytics module, which loads the Google tag. The bundle also configures Sentry to report errors to a Mapvx endpoint.

AI rationale

Evidence

dist/browser/main.js

Network endpoints2

www.googletagmanager.comsentry.mapvx.app

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The browser bundle embeds the fixed Google Analytics tracking ID `G-9KB6BB1J7M`.
The entry point initializes Google Analytics with that ID when bootstrapping the `mapvx-website` custom element; automatic page views are disabled.
The analytics module loads its tag from `www.googletagmanager.com` and runs its configured commands.
The bundle also includes a Mapvx Sentry endpoint for error reporting.
The flagged invisible character is a BOM check in an HTML/XML parser, not a bidi control used to disguise code.
The manifest's `prepare` script runs `husky`; it declares no `preinstall`, `install`, or `postinstall` hook.

Evidence against

The package is a browser component, and the examined network use is analytics, error reporting, and Mapvx service access consistent with that purpose.
The source reviewed showed no credential collection, unrelated account actions, or install-time data transfer.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStrings

Source & flagged code

3 flagged

dist/browser/chunk-D6zG2upO.jsView file

2contains invisible/control Unicode U+FEFF (zero width no-break space) `+e.extraStackTrace()),Xu(Z)}function bb(Z,ae,Te,re){Nn(`Assertion failed: `+le(Z)+`, at: `+[ae?le(ae):`unknown filename`,Te,re?le(re):`unknown function`])}function Ju(){return xe.length}function Tb(Z,ae,Te){Ne.set(Ne.subarray(ae,ae+Te),Z)}

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/browser/chunk-D6zG2upO.jsView on unpkg · L2

dist/browser/main.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/browser/main.jsView on unpkg

Findings

1 Critical1 High3 Medium7 Low

CriticalTrojan Source Unicodedist/browser/chunk-D6zG2upO.js

HighSemantic Analysis Limiteddist/browser/main.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/browser/main.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @mapvx/web-components-ssr@1.12.0.

See all versions of @mapvx/web-components-ssr for other recorded verdicts.

Review the evidence and your use of @mapvx/web-components-ssr@1.12.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 02:38:38.404Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / @mapvx/web-components-ssr / 1.12.0

@mapvx/web-components-ssr@1.12.0

A modern, framework-agnostic web component built with Angular 22 that provides an interactive map and location discovery interface.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading the browser entry point bootstraps the custom element and configures Google Analytics; Sentry reporting is initialized when errors are reported.

Impact

Visitor and application activity may be reported to Google, and error details may be sent to Mapvx, without a visible disclosure or opt-out in the inspected package files.

Mechanism

A hard-coded Google Analytics measurement ID is passed to the analytics module, which loads the Google tag. The bundle also configures Sentry to report errors to a Mapvx endpoint.

AI rationale

Evidence

dist/browser/main.js

Network endpoints2

www.googletagmanager.comsentry.mapvx.app

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The browser bundle embeds the fixed Google Analytics tracking ID `G-9KB6BB1J7M`.
The entry point initializes Google Analytics with that ID when bootstrapping the `mapvx-website` custom element; automatic page views are disabled.
The analytics module loads its tag from `www.googletagmanager.com` and runs its configured commands.
The bundle also includes a Mapvx Sentry endpoint for error reporting.
The flagged invisible character is a BOM check in an HTML/XML parser, not a bidi control used to disguise code.
The manifest's `prepare` script runs `husky`; it declares no `preinstall`, `install`, or `postinstall` hook.

Evidence against

The package is a browser component, and the examined network use is analytics, error reporting, and Mapvx service access consistent with that purpose.
The source reviewed showed no credential collection, unrelated account actions, or install-time data transfer.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStrings

Source & flagged code

3 flagged

dist/browser/chunk-D6zG2upO.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/browser/chunk-D6zG2upO.jsView on unpkg · L2

dist/browser/main.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/browser/main.jsView on unpkg

Findings

1 Critical1 High3 Medium7 Low

CriticalTrojan Source Unicodedist/browser/chunk-D6zG2upO.js

HighSemantic Analysis Limiteddist/browser/main.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/browser/main.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @mapvx/web-components-ssr@1.12.0.

See all versions of @mapvx/web-components-ssr for other recorded verdicts.

Review the evidence and your use of @mapvx/web-components-ssr@1.12.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 02:38:38.404Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.