registry / @tanay-wispr/webflow-package / 6.6.14
@tanay-wispr/webflow-package@6.6.14
Developer starter template for Finsweet projects.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows a Webflow/browser integration package whose suspicious primitives are aligned with its advertised Wispr Flow website functionality. There is no install-time execution, host-level capability, credential harvesting beyond expected browser auth/session handling, or unaligned exfiltration endpoint.
Static reason
One or more suspicious static signals were detected.
Trigger
Including dist/*.js scripts in a browser/Webflow page and user interaction with forms/auth/demo controls.
Impact
User-provided signup/auth/payment/referral/demo audio data is sent to product endpoints; no package-install or host compromise behavior found.
Mechanism
browser DOM handlers and product API calls
AI rationale
Static inspection shows a Webflow/browser integration package whose suspicious primitives are aligned with its advertised Wispr Flow website functionality. There is no install-time execution, host-level capability, credential harvesting beyond expected browser auth/session handling, or unaligned exfiltration endpoint.
Evidence
package.jsonREADME.mddist/downloads.jsdist/web-demo/index.jsdist/global.jsdist/signup.jsdist/login.jsdist/androidWaitlist.jsdist/desktopAuth.jsdist/calculator.jsdist/pricing.js
Network endpoints4
api.wisprflow.aiwss://api.wisprflow.aidodjkfqhwrzqjwkfnthl.supabase.codl.dropbox.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install/preinstall/postinstall/prepare lifecycle hooks.
- Published files are bundled browser/Webflow scripts under dist/, activated by page inclusion/user interaction.
- Network calls are product-aligned to api.wisprflow.ai and dodjkfqhwrzqjwkfnthl.supabase.co for signup, auth, pricing, downloads, and demo transcription.
- dist/downloads.js critical-looking secret is a Supabase anon JWT embedded with supabase-js client config, not a private service key by itself.
- No child_process, filesystem writes, shell execution, eval/new Function, native binary loading, persistence, or AI-agent control-surface writes found.
- Audio capture in dist/web-demo/index.js uses browser getUserMedia and sends to Wispr Flow demo APIs after page/demo interaction.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
15 flaggeddist/downloads.jsView file
1patternName = supabase_service_key
severity = critical
line = 1
matchedText = "use str...ML=`
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/downloads.jsView on unpkg · L11patternName = supabase_service_key
severity = critical
line = 1
matchedText = "use str...ML=`
Critical
Secret Pattern
Supabase service role key (JWT) in dist/downloads.js
dist/downloads.jsView on unpkg · L11patternName = generic_password
severity = medium
line = 1
matchedText = "use str...ML=`
Medium
dist/desktopAuth.jsView file
Findings
10 Critical6 Medium4 Low
CriticalCritical Secretdist/downloads.js
CriticalSecret Patterndist/downloads.js
CriticalSecret Patterndist/desktopAuth.js
CriticalSecret Patterndist/global.js
CriticalSecret Patterndist/signup.js
CriticalSecret Patterndist/login.js
CriticalSecret Patterndist/androidWaitlist.js
CriticalSecret Patterndist/calculator-business.js
CriticalSecret Patterndist/pricing.js
CriticalSecret Patterndist/calculator.js
MediumNetwork
MediumSecret Patterndist/downloads.js
MediumSecret Patterndist/desktopAuth.js
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.6.14.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.6.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.