@skhema/embed@0.5.0
Embeddable component for integrating strategic elements with Skhema.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete default-on data exfiltration of rich page/application content, not merely a network primitive. Although the endpoint is vendor-aligned and no install-time compromise behavior exists, the default collection creates a material unconsented disclosure surface. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Decision evidence
public snapshot- dist/index.cjs posts embed content, page URL/title, and user agent to analytics.skhema.com.
- Tracking is enabled unless the embed has track-analytics="false".
- Connected web components automatically call trackLoad after rendering.
- Batched sends and unload beacons make the collection persistent across navigation.
- package.json has no install lifecycle hooks.
- Network target is a named Skhema analytics endpoint and credentials are omitted.
- No shell execution, eval, environment/file harvesting, or remote code loading was found.
Source & flagged code
1 flagged · loading sourceSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/embed.min.jsView on unpkgFindings
Affected versions and remediation
This report applies to @skhema/embed@0.5.0.
See all versions of @skhema/embed for other recorded verdicts.
- Review the evidence and your use of @skhema/embed@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.