registry / @sarimarcus/content-sites-ui / 0.41.2
@sarimarcus/content-sites-ui@0.41.2
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe manifest has no install hook, and source inspection found ordinary UI, analytics, affiliate, search, and caller-configured browser-tool behavior. Network and script loading are tied to those features; no concrete malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
No attack trigger was found; analytics and affiliate loaders activate through page use, interaction, or idle callbacks.
Impact
No malicious impact was established from the inspected source.
Mechanism
No attack mechanism was identified. The observed requests go to declared analytics and affiliate services; remote browser tools require caller-provided configuration and invocation.
AI rationale
The manifest has no install hook, and source inspection found ordinary UI, analytics, affiliate, search, and caller-configured browser-tool behavior. Network and script loading are tied to those features; no concrete malicious behavior was identified.
Evidence
package.jsonsrc/layout/analytics.tssrc/layout/ConsentAnalytics.astrosrc/layout/resources.tssrc/affiliate/EmeraldLoader.astrosrc/affiliate/TravelpayoutsWidget.astrosrc/affiliate/TravelpayoutsWidgetBody.astrosrc/affiliate/resources.tssrc/affiliate/travelpayoutsStyler.tssrc/layout/webMcp.ts
Network endpoints12
www.googletagmanager.comcdn.jsdelivr.nettpwdg.comsuggest.apistp.comavsplow.comwidget.getyourguide.comtpo.ggc91.travelpayouts.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports UI modules and declares peer dependencies; it contains no install lifecycle scripts.
- The required source paths contain UI components, page templates, styles, and search helpers that render supplied content and component output.
- Analytics records page and interaction events in the browser data layer; affiliate loaders use declared partner resources and load on interaction or idle.
- WebMCP setup requires the browser API, and remote tools require a caller-supplied endpoint and definitions before they can be registered.
- The inspected source does not show credential collection, file harvesting, shell execution, or an automatic install-time network action.
Evidence against
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedsrc/affiliate/AffiliateBandShell.astroView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 102
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkgpackage.jsonView file
17"sideEffects": [
"**/*.css"
],
"files": [
"src",
"dist",
"README.md",
"CHANGELOG.md",
"LICENSE"
],
"exports": {
"./package.json": "./package.json",
Low
Suspicious Lifecycle Evidence
package.json exports UI modules and declares peer dependencies; it contains no install lifecycle scripts.
package.jsonView on unpkg · L17src/layout/analytics.tsView file
Findings
1 High1 Medium10 Low
HighSemantic Analysis Limitedsrc/affiliate/AffiliateBandShell.astro
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/layout/analytics.ts
LowAi Review Evidencesrc/affiliate/EmeraldLoader.astro
LowAi Review Evidencesrc/affiliate/TravelpayoutsWidgetBody.astro
LowAi Review Evidencesrc/layout/webMcp.ts
LowAi Review Evidencesrc/layout/webMcp.ts
LowAi Review Evidencesrc/seo/index.ts
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.41.2.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.41.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.