registry / @onefootprint/footprint-js / 6.0.0
@onefootprint/footprint-js@6.0.0
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected runtime requests are directed to OneFootprint services for diagnostics and onboarding. The telemetry includes page and browser context on error paths, but the source does not show an unrelated recipient or an attack behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
SDK warnings or errors trigger diagnostic reporting; onboarding begins through the SDK’s runtime flow.
Impact
The inspected behavior reports product diagnostics and supports identity verification; it does not establish unrelated credential collection or exfiltration.
Mechanism
Diagnostic requests carry SDK messages and, on relevant errors, browser context. Onboarding sends visit identifiers with its session authorization to the OneFootprint API.
AI rationale
The manifest has no install lifecycle hook, and the inspected runtime requests are directed to OneFootprint services for diagnostics and onboarding. The telemetry includes page and browser context on error paths, but the source does not show an unrelated recipient or an attack behavior.
Evidence
package.jsondist/footprint-js.cjs
Network endpoints2
api.onefootprint.comfp.risk.onefootprint.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to the inspected CommonJS bundle and lists no install lifecycle hook.
- The bundle sends SDK warnings and errors to the OneFootprint API; detailed browser context is attached to diagnostic errors.
- Onboarding uses a returned Fingerprint public key and sends the resulting visit identifiers with the onboarding authorization token to the OneFootprint API.
Evidence against
- The SDK can transmit the current page URL and browser characteristics in error diagnostics, but the inspected code ties that transmission to SDK warning or error paths.
Behavioral surface
EnvironmentVarsEval
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/footprint-js.cjsView file
•Credential-bearing message sent to a fixed external iframe in dist/footprint-js.cjs:
var jd=Object.create;var Qe=Object.defineProperty,$d=Object.defineProperties,Wd=Object.getOwnPropertyDescriptor,Xd=Object.getOwnPropertyDescriptors,Qd=Object.getOwnPropertyNames,Ce...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/footprint-js.cjsView on unpkg3ar we="6.0.0";var Ne="https://api.onefootprint.com",Lt=we,Nt=id,z=`${Nt}:${Lt}`;var km=2e3,Ge=e=>typeof e=="string"?e.trim()||"Unknown error":e!=null&&typeof e=="object"&&"message"in e&&typeof e.message=="string"&&e.message.trim()||"Un
Low
Ai Review Evidence
The bundle sends SDK warnings and errors to the OneFootprint API; detailed browser context is attached to diagnostic errors.
dist/footprint-js.cjsView on unpkg · L33eturn window.location.href}catch(e){return}},ud=e=>e!=="info"&&!je(),B=({info:e})=>{let t=`@onefootprint/footprint-js: ${e}`;return (je())&&console.log("[FP SDK INFO]",e),t},F=({kind:e,warning:t})=>{let r=`@onefootprint/footprint-js: ${t}`;return (je())&&console.warn("[FP SDK WARN]",t),ud("warn")&&Gt({kind:e,message:t,level:"warn",domain:dd()}),r},de=e=>{let{kind:t,error:r,context:o}=e,n=`@onefootprint/footprint-js: ${r}`;return (je())&&console.error("[FP SDK ERROR]",r,o?{context:o}:""),ud("error")&&Gt({kind:t,message:r,level:"error",domain:dd(),context:o}),n},$e=
Findings
1 Critical2 Medium9 Low
CriticalHardcoded Runtime Data Exfiltrationdist/footprint-js.cjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/footprint-js.cjs
LowAi Review Evidencedist/footprint-js.cjs
Affected versions and remediation
This report applies to @onefootprint/footprint-js@6.0.0.
See all versions of @onefootprint/footprint-js for other recorded verdicts.
- Review the evidence and your use of @onefootprint/footprint-js@6.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.