registry / @sarimarcus/content-sites-ui / 0.51.1
@sarimarcus/content-sites-ui@0.51.1
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source matches the stated Astro UI package purpose and contains no install hooks or automatic package-import actions. Network integrations are tied to analytics or affiliate components and are consent-gated or deferred.
Static reason
No blocking static signals were detected.
Trigger
Analytics and affiliate requests are associated with their components being rendered; the inspected loaders defer third-party loading until interaction or page idle.
Impact
No credential collection, unrelated data transfer, install-time activity, or other harmful behavior was identified.
Mechanism
The package queues consent-gated analytics events and loads declared GTM, consent-manager, and affiliate widget resources.
AI rationale
The source matches the stated Astro UI package purpose and contains no install hooks or automatic package-import actions. Network integrations are tied to analytics or affiliate components and are consent-gated or deferred.
Evidence
package.jsonsrc/layout/analytics.tssrc/layout/ConsentAnalytics.astrosrc/layout/resources.tssrc/affiliate/EmeraldLoader.astrosrc/affiliate/resources.tssrc/affiliate/AffiliateBandShell.astro
Network endpoints12
www.googletagmanager.comcdn.jsdelivr.netemrldtp.commn-tz.comemrld.cctpwdg.comsuggest.apistp.comavsplow.comsentry.avs.iowidget.getyourguide.comtpo.ggc91.travelpayouts.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as shared Astro UI components and exports component modules; the reviewed package metadata has no lifecycle scripts or bin.
- Analytics tracking is installed only when setupAnalytics is called, and track checks analytics consent before queuing an event.
- The GTM and consent scripts load after a user interaction or page idle when ConsentAnalytics is rendered.
- Affiliate network hosts are declared for Travelpayouts and partner widgets; Emerald loads only from its configured origin after interaction or page idle.
- The flagged AffiliateBandShell file renders a titled section and slots, matching the package's UI purpose.
Evidence against
- The package includes third-party analytics and affiliate widget integrations, which make network requests when their corresponding components are used.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedsrc/affiliate/AffiliateBandShell.astroView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 127
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkg1---
/**
* AffiliateBandShell — the titled band around an affiliate card grid: heading row with the disclosure slot, optional
* subtitle, then the grid. Internal to the affiliate sections; not exported.
*/
import { b
Low
Ai Review Evidence
The flagged AffiliateBandShell file renders a titled section and slots, matching the package's UI purpose.
src/affiliate/AffiliateBandShell.astroView on unpkg · L1package.jsonView file
1{
"name": "@sarimarcus/content-sites-ui",
"version": "0.51.1",
"description": "Universal Astro UI components, layout shell and design tokens shared by the content sites.",
"type": "module",
"license": "MIT",
"publishConfig": {
"access": "public"
},
"repository": {
"type": "git",
"url": "git+https://github.com/Sarimarcus/content-sites-factory.git"
},
"engines": {
"node": ">=22.12.0"
},
"s
Findings
1 High1 Medium10 Low
HighSemantic Analysis Limitedsrc/affiliate/AffiliateBandShell.astro
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/layout/analytics.ts
LowAi Review Evidencesrc/layout/analytics.ts
LowAi Review Evidencesrc/layout/ConsentAnalytics.astro
LowAi Review Evidencesrc/affiliate/resources.ts
LowAi Review Evidencesrc/affiliate/EmeraldLoader.astro
LowAi Review Evidencesrc/affiliate/AffiliateBandShell.astro
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.51.1.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.51.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.