@sarimarcus/content-sites-ui@0.44.0
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource review found a UI component library with no lifecycle scripts and no concrete attack behavior. The flagged network-related code supports consumer-configured affiliate embeds, analytics, and browser tools; the semantic-analysis limit does not change the inspected source behavior.
Decision evidence
public snapshot- The manifest identifies this as an Astro UI library and exports source modules; its ending declares peer dependencies and no lifecycle scripts.
- The required component, navigation, search, SEO, and style files contain UI and presentation code; their inspected excerpts show no attack behavior.
- Analytics checks consent before adding interaction events to the page data layer; the consent component documents deferred Google Tag Manager loading.
- Browser tools use a consumer-provided endpoint and tool definitions, and register only when the browser exposes the model context API.
- Affiliate widgets load their widget script when rendered; the styler modifies widget presentation and observes widget DOM.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkgThe required component, navigation, search, SEO, and style files contain UI and presentation code; their inspected excerpts show no attack behavior.
src/affiliate/AffiliateBandShell.astroView on unpkg · L1Findings
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.44.0.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.44.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.