@sarimarcus/content-sites-ui@0.40.0
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no lifecycle hook, and the required component file contains ordinary rendering logic. Inspected network-capable modules are tied to site affiliate functionality, consent-aware tracking, or caller-configured browser tools; no concrete attack behavior was found.
Decision evidence
public snapshot- package.json exposes UI and utility modules and contains no install lifecycle hook.
- AffiliateBandShell.astro renders a section, title, and slots from component props.
- Analytics tracking checks analytics consent and supports caller-configured optional tracking.
- WebMCP setup returns when the browser API is absent and uses the configured page origin.
- The affiliate loader requires a numeric site tracking ID and loads after interaction or page idle.
Source & flagged code
7 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkgAffiliateBandShell.astro renders a section, title, and slots from component props.
src/affiliate/AffiliateBandShell.astroView on unpkg · L20Findings
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.40.0.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.40.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.