registry  /  @snippyly/plugin  /  1.0.242

@snippyly/plugin@1.0.242

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime browser code loads package-aligned Superflow/Velt SDK/UI resources and communicates with product APIs when the toolbar/plugin is used.

Static reason
One or more suspicious static signals were detected.
Trigger
Importing/using snippyly.js in a browser page or loading the custom element.
Impact
Expected Superflow/Velt collaboration toolbar behavior; no install-time or host-level compromise identified.
Mechanism
browser toolbar/plugin bundle with product API calls and dynamic SDK script injection
Rationale
Static inspection shows a bundled browser collaboration plugin with product-aligned network calls and no lifecycle execution, filesystem access, shell execution, persistence, credential harvesting, or agent control mutation. Scanner signals are explainable by normal browser SDK loading, Firebase defaults/session storage, and public asset/API identifiers.
Evidence
package.jsonsnippyly.jssnippyly.min.js
Network endpoints7
cdn.velt.dev/lib/sdk@serveprivatenpmpackage-4mfhcuyw2q-uc.a.run.app/sdk-staging/lib/sdk@serveprivatenpmpackage-4mfhcuyw2q-uc.a.run.app/sdk-dev/lib/sdk@app.usesuperflow.com/api.velt.dev/saapi.velt.dev/v2/sf/tbfirebasestorage.googleapis.com/

Decision evidence

public snapshot
AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
  • snippyly.js dynamically injects Velt SDK script from cdn.velt.dev or serveprivatenpmpackage-4mfhcuyw2q-uc.a.run.app at runtime.
  • snippyly.js contains browser storage/cookie/token strings for Superflow/Velt session state, but within toolbar auth/comment features.
Evidence against
  • package.json has no preinstall/install/postinstall lifecycle hooks; main is snippyly.js.
  • Only package files present are package.json, snippyly.js, and snippyly.min.js.
  • snippyly.js is a browser Lit custom element bundle exporting SnippylyPlugin and SuperflowToolbar.
  • No child_process, filesystem mutation, native binary loading, or AI-agent control-surface writes found.
  • Network hosts are aligned with Superflow/Velt/Firebase toolbar, SDK, auth, storage, and asset functionality.
  • The high-secret hint appears to match bundled public app/API identifiers or asset tokens, not credential harvesting/exfiltration.
Behavioral surface
Source
ChildProcessEnvironmentVarsNetwork
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 1.19 MB of source, external domains: apis.google.com, app.usesuperflow.com, cdn.velt.dev, drive.google.com, firebasestorage.googleapis.com, fonts.googleapis.com, join.slack.com, serveprivatenpmpackage-4mfhcuyw2q-uc.a.run.app, us-central1-snippyly-sdk-prod.cloudfunctions.net, www.apache.org, www.google.com, www.usesuperflow.com, www.w3.org

Source & flagged code

3 flagged · loading source
snippyly.min.jsView file
1545patternName = google_api_key severity = high line = 1545 matchedText = calc(${t...d=l`
High
High Secret

Package contains a high-severity secret pattern.

snippyly.min.jsView on unpkg · L1545
1545patternName = google_api_key severity = high line = 1545 matchedText = calc(${t...d=l`
High
Secret Pattern

Google API key in snippyly.min.js

snippyly.min.jsView on unpkg · L1545
snippyly.jsView file
1545patternName = google_api_key severity = high line = 1545 matchedText = calc(${t...d=a`
High
Secret Pattern

Google API key in snippyly.js

snippyly.jsView on unpkg · L1545

Findings

3 High2 Medium3 Low
HighHigh Secretsnippyly.min.js
HighSecret Patternsnippyly.min.js
HighSecret Patternsnippyly.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings