registry / @skhema/embed / 0.3.0
@skhema/embed@0.3.0
Embeddable component for integrating strategic elements with Skhema.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's exfiltration signal corresponds to disclosed, package-aligned browser analytics for the embed component, not credential theft or covert payload behavior. Source inspection found no install-time execution or malicious execution chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A <skhema-element> or <skhema-component> with a contributor ID connects in a browser.
Impact
Posts the embedded content and page metadata to Skhema's analytics endpoint; no host credentials are included.
Mechanism
Batched first-party embed analytics via fetch/sendBeacon.
AI rationale
The scanner's exfiltration signal corresponds to disclosed, package-aligned browser analytics for the embed component, not credential theft or covert payload behavior. Source inspection found no install-time execution or malicious execution chain.
Evidence
package.jsondist/index.cjsdist/index.es.jsdist/embed.min.jsREADME.md
Network endpoints4
analytics.skhema.com/functions/v1/embed-manageanalytics.skhema.comskhema.comapp.skhema.com/save
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- Runtime posts embed content, page URL/title, and user agent to analytics.skhema.com.
- Analytics is enabled unless the rendered element sets track-analytics="false".
- A 24-hour _sk cookie deduplicates tracked content hashes.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Network activity is confined to the named Skhema analytics endpoint and uses credentials:"omit".
- Tracking activates only when browser custom elements are connected and a contributor ID is present.
- No credential harvesting, filesystem access, shell execution, dynamic code execution, or remote payload loading found.
Behavioral surface
Network
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
1 flagged · loading sourcedist/embed.min.jsView file
•Browser cookie sent to a fixed external endpoint in dist/embed.min.js:
!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/embed.min.jsView on unpkgFindings
1 Critical2 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/embed.min.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @skhema/embed@0.3.0.
See all versions of @skhema/embed for other recorded verdicts.
- Review the evidence and your use of @skhema/embed@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.