@medusa-it/cartlift
Cartlift for BigCommerce: a slide-out cart drawer with threshold bars, free gifts, recommendations, quantity breaks and add-ons — on Catalyst's own cart server actions, or on Stencil themes through the Storefront API.
This report shows the evidence for @medusa-it/cartlift@0.1.1, the only known version.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends undocumented runtime analytics about shopper interactions to a target supplied by its Cartlift configuration. The observed payloads are limited to event and product-related identifiers, so this warrants a warning for telemetry rather than a malicious verdict.
Decision evidence
public snapshot- The client batches analytics events and sends them to a configured URL at `/v1/events`.
- When the returned config enables the drawer, client actions track events such as opens and upsell adds with product and rule IDs.
- The package does not document this shopper analytics collection or describe a way for shoppers to disable it.
- The manifest has no install, preinstall, or postinstall scripts.
- The analytics target is supplied by configuration; the reviewed source does not hard-code an unrelated collector host.
- The tracked events contain interaction types and product or rule IDs, with no credential or machine data shown.
Source & flagged code
4 flaggedThe client batches analytics events and sends them to a configured URL at `/v1/events`.
dist/client/events.jsView on unpkg · L1When the returned config enables the drawer, client actions track events such as opens and upsell adds with product and rule IDs.
dist/client/Provider.jsView on unpkg · L118Findings
Affected versions and remediation
This report applies to @medusa-it/cartlift@0.1.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @medusa-it/cartlift@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.