@sarimarcus/content-sites-ui@0.42.2
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe manifest contains no lifecycle hooks, and the high-severity parser hint points to a normal Astro UI component. The inspected network references support affiliate widgets, consent-managed analytics, and explicitly invoked browser tools; no credential collection, stealth, or unauthorized mutation was identified.
Decision evidence
public snapshot- package.json exposes Astro UI component modules and has no lifecycle scripts; the required affiliate, editorial, layout, navigation, primitive, search, SEO, and style source paths were inspected and their excerpts describe UI components, rendering, or styles.
- The flagged affiliate component renders a titled section and slots; affiliate loaders use configured Travelpayouts resources and defer the Emerald script until interaction or idle time.
- The WebMCP module exposes browser tools that load resources on demand, and analytics events are pushed to the page data layer subject to the consent check.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkgpackage.json exposes Astro UI component modules and has no lifecycle scripts; the required affiliate, editorial, layout, navigation, primitive, search, SEO, and style source paths were inspected and their excerpts describe UI components, rendering, or styles.
src/affiliate/AffiliateBandShell.astroView on unpkg · L1Findings
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.42.2.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.42.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.