@skhema/embed@0.5.1
Embeddable component for integrating strategic elements with Skhema.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains default-on telemetry that transmits rich caller-provided content to a vendor endpoint. This is suspicious data collection rather than evidence of malware, because it has no install hook, credential access, or hidden payload execution.
Decision evidence
public snapshot- The browser component sends embedded content, page URL, page title, and user agent to a Skhema analytics endpoint.
- Analytics is enabled unless the embedding element explicitly sets track-analytics to false.
- Load tracking runs when a rendered custom element has a contributor ID, without a click or separate consent action.
- There are no npm install lifecycle hooks.
- Requests omit browser credentials.
- The network behavior is limited to the package's named analytics service and embed telemetry.
Source & flagged code
5 flagged · loading sourceSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/embed.min.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/embed.min.js#virtual:string-array:round1View on unpkgFindings
Affected versions and remediation
This report applies to @skhema/embed@0.5.1.
See all versions of @skhema/embed for other recorded verdicts.
- Review the evidence and your use of @skhema/embed@0.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.