@nizza/core@0.8.6
The `core` library contains reusable code pieces and standards that can be utilized across other libraries and applications within the monorepo. These code pieces are independent of dependencies from other libraries in the monorepo but are essential for c
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe default logger can transmit application log records to the package’s Nizza service during normal browser use, with no clear disclosure or opt-out apparent in the inspected code. This supports a warning for undisclosed runtime telemetry, not a finding of credential theft.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Application use of the default logger, followed by page unload when pending logs exist.
Impact
Application log contents may be transmitted to Nizza without clear disclosure, creating an undisclosed runtime telemetry risk.
Mechanism
The logger saves records for HTTP delivery and uses sendBeacon with its configured endpoint; the bundle also defines Nizza core-service URLs.
AI rationale
The default logger can transmit application log records to the package’s Nizza service during normal browser use, with no clear disclosure or opt-out apparent in the inspected code. This supports a warning for undisclosed runtime telemetry, not a finding of credential theft.
Evidence
dist/index.mjs
Network endpoints4
core-services-prod.nizza.com/apicore-services-prod.nizza.com/graphql/v1/telemetry/logscognito-idp.<region>.amazonaws.com/
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundle configures Nizza core services at core-services-prod.nizza.com.
- The logger saves warning-and-higher log records for HTTP delivery and sends pending records when the page unloads.
- The package creates a default Nizza logger and store as part of its core initialization.
Evidence against
- The package is a browser-oriented core library with no install lifecycle scripts.
- Cognito authentication requests go to the configured AWS Cognito endpoint, consistent with normal authentication behavior.
Behavioral surface
CryptoNetworkWebSocket
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/index.mjsView file
213};
L214: return k.write(x, A, ...E);
L215: }, c = (b, ...k) => {
...
L308: const A_ = () => (Js || (Js = E_(), (Bn ? "production" : void 0) !== "production" && (globalThis.__JOTAI_DEFAULT_STORE__ || (globalThis.__JOTAI_DEFAULT_STORE__ = Js), globalThis.__...
L309: "Detected multiple Jotai instances. It may cause unexpected behavior with the default store. https://github.[redacted]"
L310: ))), Js), qy = {}, C_ = jy(
...
L7851: *
L7852: * @private
L7853: * @param {MessageEvent} event - The received message event.
...
L7999: for (var h = "", p = 1 - o, v = -1, g = n && n.length || 0, b = 0; b < g; ) {
L8000: if (n.charCodeAt(b) === 37 && b + 1 < g) {
L8001: switch (v = v > -1 ? v : 0, n.charCodeAt(b + 1)) {
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/index.mjsView on unpkg · L213213Trigger-reachable chain: manifest.module -> dist/index.mjs
L213: };
L214: return k.write(x, A, ...E);
L215: }, c = (b, ...k) => {
...
L308: const A_ = () => (Js || (Js = E_(), (Bn ? "production" : void 0) !== "production" && (globalThis.__JOTAI_DEFAULT_STORE__ || (globalThis.__JOTAI_DEFAULT_STORE__ = Js), globalThis.__...
L309: "Detected multiple Jotai instances. It may cause unexpected behavior with the default store. https://github.[redacted]"
L310: ))), Js), qy = {}, C_ = jy(
...
L7851: *
L7852: * @private
L7853: * @param {MessageEvent} event - The received message event.
...
L7999: for (var h = "", p = 1 - o, v = -1, g = n && n.length || 0, b = 0; b < g; ) {
L8000: if (n.charCodeAt(b) === 37 && b + 1 < g) {
L8001: switch (v = v > -1 ? v : 0, n.charCodeAt(b + 1)) {
Critical
Findings
2 Critical6 Medium4 Low
CriticalBrowser Credential Phishingdist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencepackage.json
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @nizza/core@0.8.6.
See all versions of @nizza/core for other recorded verdicts.
- Review the evidence and your use of @nizza/core@0.8.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.