@sarimarcus/content-sites-ui@0.50.0
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install-time attack behavior, but its production analytics component grants analytics storage before loading GTM, creating a credible risk of tracking visitors before consent. Because the analytics feature is explicit and includes a consent manager, this warrants a warning rather than a publish block.
Decision evidence
public snapshot- ConsentAnalytics sets Google Tag Manager’s default analytics_storage consent to granted before loading GTM.
- When the component is used in production, GTM and Silktide load on interaction or after page load; GTM receives dataLayer events.
- Analytics events include the page path, and FAQ tracking can include the displayed question text.
- package.json has no lifecycle scripts and exports the UI modules as package entry points.
- Analytics is provided through an explicit component and setup function, and the component accepts a caller-supplied GTM ID.
- The source defines a cookie-preferences control and initializes Silktide’s consent manager.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkgConsentAnalytics sets Google Tag Manager’s default analytics_storage consent to granted before loading GTM.
src/layout/ConsentAnalytics.astroView on unpkg · L54Findings
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.50.0.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.50.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.