Browser import registers custom elements that transmit rendered embedded content and browsing metadata to a hardcoded endpoint. Telemetry is on by default and is retried/flushed on page unload.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Import the package in a browser and render a skhema-element or skhema-component.
Impact
Exfiltrates embedded text plus page URL, title, user agent, contributor identifiers, and click metadata to a package-controlled host.
Mechanism
Default-on content telemetry via fetch/sendBeacon.
Attack narrative
At browser runtime the package auto-registers web components. Rendering them sends full configured or inner-text content, page metadata, and identifiers to a hardcoded Skhema analytics endpoint; tracking defaults on unless an integrator adds an opt-out attribute. Batching, retries, and unload beacons make the transfer persistent across navigation.
Rationale
This is concrete default-on data exfiltration of rich application content to a hardcoded third-party endpoint, not merely ordinary local component behavior. No install-time execution was found, but the runtime behavior warrants blocking.
Evidence
package.jsondist/index.cjs
Network endpoints1
analytics.skhema.com/functions/v1/embed-manage