registry / @sarimarcus/content-sites-ui / 0.55.1
@sarimarcus/content-sites-ui@0.55.1
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 10h ago · by lpm-firewall-aiThe package exports Astro UI components without install hooks. The reviewed network and filesystem references are attributable to its analytics, affiliate, browser search, and schema-generation features, with no attack behavior identified.
Static reason
No blocking static signals were detected.
Trigger
Site code opts into analytics or WebMCP setup, a rendered affiliate widget loads, or schema input is generated during a build.
Impact
The reviewed behavior is consistent with the package’s UI and site integration purpose; no credential collection, unrelated data transfer, or harmful automatic action was found.
Mechanism
Browser analytics events enter dataLayer; configured affiliate widgets use partner URLs; WebMCP tools are registered only when the browser supports document.modelContext; schema generation checks public asset existence.
AI rationale
The package exports Astro UI components without install hooks. The reviewed network and filesystem references are attributable to its analytics, affiliate, browser search, and schema-generation features, with no attack behavior identified.
Evidence
package.jsonsrc/layout/analytics.tssrc/layout/webMcp.tssrc/affiliate/resources.tssrc/seo/schemaContext.ts
Network endpoints6
tpwdg.comc91.travelpayouts.comwidget.getyourguide.comwww.omio.comwww.discovercars.comwww.googletagmanager.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes UI component modules and declares no lifecycle scripts.
- Analytics records page and interaction events through the browser dataLayer, with an analytics consent check.
- WebMCP support is read-only and only initializes when the browser exposes document.modelContext; remote calls require configured endpoint and tool definitions.
- Affiliate widget URLs are for Travelpayouts and partner services, consistent with the package’s affiliate UI purpose.
- Filesystem access in schemaContext checks whether a public asset exists to build schema input.
Evidence against
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedsrc/affiliate/AffiliateBandShell.astroView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 129
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkgpackage.jsonView file
27"exports": {
"./package.json": "./package.json",
"./primitives": "./src/primitives/index.ts",
"./composed": "./src/composed/index.ts",
"./editorial": "./src/editorial/index.ts",
"./affiliate": "./src/affiliate/index.ts",
"./travelpayouts-styler": "./[redacted].ts",
"./seo": "./src/seo/i
Low
Suspicious Lifecycle Evidence
The manifest exposes UI component modules and declares no lifecycle scripts.
package.jsonView on unpkg · L27src/layout/analytics.ts
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limitedsrc/affiliate/AffiliateBandShell.astro
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/layout/analytics.ts
LowAi Review Evidencesrc/layout/webMcp.ts
LowAi Review Evidencesrc/affiliate/resources.ts
LowAi Review Evidencesrc/seo/schemaContext.ts
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.55.1.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.55.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.