@sarimarcus/content-sites-ui@0.55.0
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 10h ago · by lpm-firewall-aiThe package exposes Astro UI components and browser utilities, with no install lifecycle scripts in its manifest. The flagged network behavior is consistent with affiliate widgets, consent analytics, and optional caller-configured WebMCP tools.
Decision evidence
public snapshot- package.json defines component and utility exports, with no lifecycle scripts or executable bin entry.
- Analytics events are pushed to the browser dataLayer and respect the consent manager when it is available.
- WebMCP remote calls require a configured endpoint and registered tool, and run when the tool is invoked.
- Affiliate scripts load from the documented Travelpayouts host after user interaction or page idle; the scanner-flagged Astro component only renders props and slots.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkgAffiliate scripts load from the documented Travelpayouts host after user interaction or page idle; the scanner-flagged Astro component only renders props and slots.
src/affiliate/AffiliateBandShell.astroView on unpkg · L18Findings
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.55.0.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.55.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.