@mapvx/web-components-ssr@1.8.0
A modern, framework-agnostic web component built with Angular 22 that provides an interactive map and location discovery interface.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe component automatically includes a caller-provided API key in analytics events sent to Google Analytics. This exposes a credential to a host outside the key’s intended service, so the package is malicious.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Automatic when the web component is instantiated and analytics events are logged; supplying the component’s API key populates the analytics logger.
Impact
The API key is disclosed to an unrelated analytics provider, where it could be used outside its intended Mapvx API context.
Mechanism
The logger adds its apiKey field to event payloads and submits them through a Google Analytics service configured with a hard-coded tracking ID.
Attack narrative
When the browser component starts, it initializes analytics and logs a session event. Once the caller supplies a Mapvx API key, the component stores it in the analytics logger. That logger includes the key in event payloads sent through the package’s default Google Analytics configuration, disclosing the key to Google without user consent.
AI rationale
The component automatically includes a caller-provided API key in analytics events sent to Google Analytics. This exposes a credential to a host outside the key’s intended service, so the package is malicious.
Evidence
dist/browser/main.js
Network endpoints1
www.googletagmanager.com/gtag/js?id=G-9KB6BB1J7M
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The bundle loads Google’s gtag script and configures a hard-coded Google Analytics tracking ID by default.
- The component accepts an API key and stores it in the logger; each analytics event includes that key in its payload.
- The component starts analytics session events automatically when instantiated.
Evidence against
- The package is a browser mapping component, and the bundle also contains ordinary map SDK functionality.
- The flagged BOM character appears in an XML/HTML parser’s standard handling of a leading byte-order mark.
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
3 flaggeddist/browser/chunk-D6zG2upO.jsView file
2contains invisible/control Unicode U+FEFF (zero width no-break space)
`+e.extraStackTrace()),Xu(Z)}function bb(Z,ae,Te,re){Nn(`Assertion failed: `+le(Z)+`, at: `+[ae?le(ae):`unknown filename`,Te,re?le(re):`unknown function`])}function Ju(){return xe.length}function Tb(Z,ae,Te){Ne.set(Ne.subarray(ae,ae+Te),Z)}
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/browser/chunk-D6zG2upO.jsView on unpkg · L2dist/browser/main.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/browser/main.jsView on unpkg4e.uri=e.uri||`https://www.googletagmanager.com/gtag/js?id=${e.trackingCode}`,e.initCommands=e?.initCommands??[],e.initCommands.find(o=>o.command===`config`)||e.initCommands.unshift({com
Findings
1 Critical2 High2 Medium7 Low
CriticalTrojan Source Unicodedist/browser/chunk-D6zG2upO.js
HighSemantic Analysis Limiteddist/browser/main.js
HighAi Review Evidencedist/browser/main.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @mapvx/web-components-ssr@1.8.0.
See all versions of @mapvx/web-components-ssr for other recorded verdicts.
- Avoid installing @mapvx/web-components-ssr@1.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.