registry / Telemetry / @silarhi/docs-kit / 0.10.1

@silarhi/docs-kit@0.10.1

Shared Starlight preset for the documentation of SILARHI open-source packages

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The preset enables search-query analytics by default for mapped slugs, and the package README does not disclose that collection. This is a runtime telemetry concern, not evidence of credential theft or install-time abuse.

Static reason

No blocking static signals were detected.

Trigger

A site uses defineSilarhiDocs with a slug that has a default Umami ID; tracking runs in readers’ browsers when they search.

Impact

Readers’ free-text search terms are disclosed to the site operator’s analytics service without clear disclosure in the package README.

Mechanism

The preset injects an Umami script and a listener that submits search queries and result counts to that analytics instance.

AI rationale

Evidence

index.tspackages.jsscripts/track-search.jsREADME.mdog-image.ts

Network endpoints3

analytics.silarhi.dev/script.jsUmami event endpoint loaded by the analytics scriptapi.fontsource.org/v1/fonts/{file}

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

For matching package slugs, defineSilarhiDocs defaults Umami to a registry-specified website ID.
The preset injects the analytics script from analytics.silarhi.dev when an Umami ID is present.
The injected search listener sends readers’ search queries and result counts to Umami.
README.md does not disclose this default search-query tracking.

Evidence against

Tracking is conditional on an Umami ID; custom slugs without a configured ID do not get the tracking scripts.
The separate api.fontsource.org request fetches fonts used to render generated Open Graph images.
The package manifest has no lifecycle scripts.

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 31.0 KB of source, external domains: analytics.silarhi.dev, api.fontsource.org, github.com, opensource.org, schema.org, silarhi.fr

Source & flagged code

5 flagged

index.tsView file

196umami = packages.find((pkg) => pkg.slug === slug)?.umami, sidebar, versions = [], currentVersion, starlight: extra = {}, astro = {}, }: SilarhiDocsOptions) {

Medium

Ai Review Evidence

For matching package slugs, defineSilarhiDocs defaults Umami to a registry-specified website ID.

index.tsView on unpkg · L196

16const UMAMI_SCRIPT = 'https://analytics.silarhi.dev/script.js' const faviconFile = new URL('./assets/favicon.png', import.meta.url) const trackSearchF

Medium

Ai Review Evidence

The preset injects the analytics script from analytics.silarhi.dev when an Umami ID is present.

index.tsView on unpkg · L16

109/** ID of the site's own website on https://analytics.silarhi.fr: no tracking without it. */ umami?: string } /** * Starlight plugin applying the SILARHI branding:

Medium

Ai Review Evidence

The preset injects the analytics script from analytics.silarhi.dev when an Umami ID is present.

index.tsView on unpkg · L109

Findings

6 Medium3 Low

MediumNetwork

MediumAi Review Evidenceindex.ts

MediumAi Review Evidencescripts/track-search.js

MediumAi Review Evidencepackages.js

MediumAi Review Evidenceindex.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @silarhi/docs-kit@0.10.1.

See all versions of @silarhi/docs-kit for other recorded verdicts.

Review the evidence and your use of @silarhi/docs-kit@0.10.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 21:51:14.456Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / @silarhi/docs-kit / 0.10.1

@silarhi/docs-kit@0.10.1

Shared Starlight preset for the documentation of SILARHI open-source packages

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A site uses defineSilarhiDocs with a slug that has a default Umami ID; tracking runs in readers’ browsers when they search.

Impact

Readers’ free-text search terms are disclosed to the site operator’s analytics service without clear disclosure in the package README.

Mechanism

The preset injects an Umami script and a listener that submits search queries and result counts to that analytics instance.

AI rationale

Evidence

index.tspackages.jsscripts/track-search.jsREADME.mdog-image.ts

Network endpoints3

analytics.silarhi.dev/script.jsUmami event endpoint loaded by the analytics scriptapi.fontsource.org/v1/fonts/{file}

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

For matching package slugs, defineSilarhiDocs defaults Umami to a registry-specified website ID.
The preset injects the analytics script from analytics.silarhi.dev when an Umami ID is present.
The injected search listener sends readers’ search queries and result counts to Umami.
README.md does not disclose this default search-query tracking.

Evidence against

Tracking is conditional on an Umami ID; custom slugs without a configured ID do not get the tracking scripts.
The separate api.fontsource.org request fetches fonts used to render generated Open Graph images.
The package manifest has no lifecycle scripts.

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 31.0 KB of source, external domains: analytics.silarhi.dev, api.fontsource.org, github.com, opensource.org, schema.org, silarhi.fr

Source & flagged code

5 flagged

index.tsView file

196umami = packages.find((pkg) => pkg.slug === slug)?.umami, sidebar, versions = [], currentVersion, starlight: extra = {}, astro = {}, }: SilarhiDocsOptions) {

Medium

Ai Review Evidence

For matching package slugs, defineSilarhiDocs defaults Umami to a registry-specified website ID.

index.tsView on unpkg · L196

16const UMAMI_SCRIPT = 'https://analytics.silarhi.dev/script.js' const faviconFile = new URL('./assets/favicon.png', import.meta.url) const trackSearchF

Medium

Ai Review Evidence

The preset injects the analytics script from analytics.silarhi.dev when an Umami ID is present.

index.tsView on unpkg · L16

109/** ID of the site's own website on https://analytics.silarhi.fr: no tracking without it. */ umami?: string } /** * Starlight plugin applying the SILARHI branding:

Medium

Ai Review Evidence

The preset injects the analytics script from analytics.silarhi.dev when an Umami ID is present.

index.tsView on unpkg · L109

Findings

6 Medium3 Low

MediumNetwork

MediumAi Review Evidenceindex.ts

MediumAi Review Evidencescripts/track-search.js

MediumAi Review Evidencepackages.js

MediumAi Review Evidenceindex.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @silarhi/docs-kit@0.10.1.

See all versions of @silarhi/docs-kit for other recorded verdicts.

Review the evidence and your use of @silarhi/docs-kit@0.10.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 21:51:14.456Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.