registry / @tanay-wispr/webflow-package / 6.7.0
@tanay-wispr/webflow-package@6.7.0
Developer starter template for Finsweet projects.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe bundle contains privacy-sensitive product telemetry, but it is tied to the branded WisprFlow download flow and its matching backend. No install-time execution or concrete malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A Webflow page loads the downloads bundle and runs its authenticated download flow.
Impact
The flow may transmit user and advertising identifiers for download tracking.
Mechanism
Browser telemetry POST to the product API.
AI rationale
The bundle contains privacy-sensitive product telemetry, but it is tied to the branded WisprFlow download flow and its matching backend. No install-time execution or concrete malicious behavior was found.
Evidence
package.jsondist/downloads.jsREADME.md
Network endpoints1
api.wisprflow.ai/api/v1/tracking/events
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The downloads-page bundle posts email and advertising identifiers to the WisprFlow tracking API during its download flow.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- The network receiver is aligned with the @tanay-wispr package name and the bundle's Flow product UI.
- No shell execution, filesystem access, dynamic code execution, or agent-control configuration mutation was found.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/downloads.jsView file
•Browser cookie sent to a fixed external endpoint in dist/downloads.js:
"use strict";(()=>{var Es=Object.create;var et=Object.defineProperty;var Ts=Object.getOwnPropertyDescriptor;var xs=Object.getOwnPropertyNames;var As=Object.getPrototypeOf,Rs=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/downloads.jsView on unpkg1patternName = generic_password
severity = medium
line = 1
matchedText = "use str...ML=`
Medium
dist/desktopAuth.jsView file
1patternName = generic_password
severity = medium
line = 1
matchedText = "use str...)();
Medium
Findings
1 Critical7 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/downloads.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.7.0.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.