registry / @tanay-wispr/webflow-package / 6.7.1
@tanay-wispr/webflow-package@6.7.1
Developer starter template for Finsweet projects.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe flagged network behavior is visible, but it is confined to a user-facing browser service flow and targets the named Wispr Flow service. There is no lifecycle execution or concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A host page loads dist/downloads.js through its Webflow callback.
Impact
The intended web flow can send account and download telemetry to the named service; no install-time or host-level attack was found.
Mechanism
Browser account and download analytics requests.
AI rationale
The flagged network behavior is visible, but it is confined to a user-facing browser service flow and targets the named Wispr Flow service. There is no lifecycle execution or concrete malicious chain.
Evidence
package.jsondist/downloads.js
Network endpoints2
api.wisprflow.ai/api/v1/tracking/eventsdodjkfqhwrzqjwkfnthl.supabase.co
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The downloads bundle posts download analytics, including an email and advertising identifiers, to the Wispr Flow API.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- The observed requests implement browser sign-in, subscription, referral, waitlist, and download flows against the named service.
- The code activates through a Webflow browser callback, not during npm installation.
- No package-authored shell execution, filesystem access, native loading, or AI-agent configuration changes were found.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/downloads.jsView file
•Browser cookie sent to a fixed external endpoint in dist/downloads.js:
"use strict";(()=>{var Es=Object.create;var et=Object.defineProperty;var Ts=Object.getOwnPropertyDescriptor;var xs=Object.getOwnPropertyNames;var As=Object.getPrototypeOf,Rs=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/downloads.jsView on unpkg1patternName = generic_password
severity = medium
line = 1
matchedText = "use str...ML=`
Medium
1fetch("https://api.wisprflow.ai/api/v1/tracking/events",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({event_name:"app_download",event_id:crypto.randomUUID(),wispr_user_id:x||void 0,email:T||void 0,fbp:R._fbp||void 0,fbc:R._fbc||void 0,gclid:ps(R),ga_client_id:L,ga_session_id:Ze})}).catch(()=>{})
Low
Ai Review Evidence
The downloads bundle posts download analytics, including an email and advertising identifiers, to the Wispr Flow API.
Findings
1 Critical7 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/downloads.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencedist/downloads.js
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.7.1.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.