registry / @tanay-wispr/webflow-package / 6.6.18
@tanay-wispr/webflow-package@6.6.18
Developer starter template for Finsweet projects.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows a Webflow browser bundle with package-aligned signup, auth, analytics, downloads, and user-invoked voice transcription. The scanner's critical secret signal is a public Supabase anonymous JWT; no concrete malicious execution, persistence, credential harvesting, or foreign control-surface mutation was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Browser page load and explicit user actions such as downloading, signing in, or starting the voice demo.
Impact
User-entered account, download, analytics, and demo-audio data is sent to package-aligned Wispr services; no unconsented host mutation or code execution is established.
Mechanism
User-facing HTTPS/WebSocket API calls from bundled Webflow scripts.
AI rationale
Static inspection shows a Webflow browser bundle with package-aligned signup, auth, analytics, downloads, and user-invoked voice transcription. The scanner's critical secret signal is a public Supabase anonymous JWT; no concrete malicious execution, persistence, credential harvesting, or foreign control-surface mutation was found.
Evidence
package.jsondist/downloads.jsdist/web-demo/index.jsdist/login.jsdist/signup.jsdist/desktopAuth.jsdist/androidWaitlist.js
Network endpoints6
api.wisprflow.aiapi.wisprflow.ai/api/v1/tracking/eventsapi.wisprflow.ai/api/v1/dash/webflow_demo/generate_tokenapi.wisprflow.ai/api/v1/dash/client_apiwss://api.wisprflow.ai/api/v1/dash/client_ws?client_key=Bearerdodjkfqhwrzqjwkfnthl.supabase.co
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- `dist/downloads.js` posts download analytics including user-provided/localStorage identifiers to the Wispr API.
- `dist/web-demo/index.js` records microphone audio and sends it to Wispr transcription endpoints after demo recording is started.
Evidence against
- `package.json` has no preinstall, install, postinstall, or other lifecycle hook.
- Published files are browser bundles; no child-process, filesystem, shell, eval, or dynamic-code execution was found.
- `dist/downloads.js` JWT is a Supabase `anon` key used with the public project URL, not evidence of a private credential.
- WebSocket/audio transport in `dist/web-demo/index.js` is tied to an explicit web demo recording flow.
- No AI-agent configuration paths, persistence mechanisms, or destructive filesystem behavior were found.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
15 flaggeddist/downloads.jsView file
1patternName = supabase_service_key
severity = critical
line = 1
matchedText = "use str...ML=`
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/downloads.jsView on unpkg · L11patternName = supabase_service_key
severity = critical
line = 1
matchedText = "use str...ML=`
Critical
Secret Pattern
Supabase service role key (JWT) in dist/downloads.js
dist/downloads.jsView on unpkg · L11patternName = generic_password
severity = medium
line = 1
matchedText = "use str...ML=`
Medium
dist/desktopAuth.jsView file
Findings
10 Critical6 Medium4 Low
CriticalCritical Secretdist/downloads.js
CriticalSecret Patterndist/downloads.js
CriticalSecret Patterndist/desktopAuth.js
CriticalSecret Patterndist/global.js
CriticalSecret Patterndist/signup.js
CriticalSecret Patterndist/login.js
CriticalSecret Patterndist/androidWaitlist.js
CriticalSecret Patterndist/calculator-business.js
CriticalSecret Patterndist/pricing.js
CriticalSecret Patterndist/calculator.js
MediumNetwork
MediumSecret Patterndist/downloads.js
MediumSecret Patterndist/desktopAuth.js
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.6.18.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.6.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.