registry / @tanay-wispr/webflow-package / 6.7.13
@tanay-wispr/webflow-package@6.7.13
Developer starter template for Finsweet projects.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected behavior is consistent with browser authentication and waitlist functionality, with credentials sent to the intended service and uploads initiated by user interaction. The missing declared entrypoint is a packaging issue rather than evidence of malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Webflow page initialization and user interaction activate the browser features; no automatic npm install hook is present.
Impact
No malicious mutation, unrelated credential export, or remote code execution was established.
Mechanism
Authenticated requests use a fixed service destination, and screenshot uploads use files selected by the user.
AI rationale
Inspected behavior is consistent with browser authentication and waitlist functionality, with credentials sent to the intended service and uploads initiated by user interaction. The missing declared entrypoint is a packaging issue rather than evidence of malicious behavior.
Network endpoints2
api.wisprflow.aiapi.wisprflow.ai/auth/web-to-desktop
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no automatic install lifecycle hooks or runtime self-dependency.
- dist/androidWaitlist.js fixes its API destination to https://api.wisprflow.ai.
- Screenshot submission sends a selected file to the authenticated waitlist API and starts from a file-input change event.
- dist/desktopAuth.js transfers authentication to a fixed Wispr service endpoint.
Evidence against
- The declared src/index.ts entrypoint is absent from the published snapshot.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggeddist/downloads.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
dist/androidWaitlist.jsView file
•Browser cookie sent to a fixed external endpoint in dist/androidWaitlist.js:
"use strict";(()=>{var Vi=Object.create;var Ht=Object.defineProperty;var Bi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Ji=Object.getPrototypeOf,Gi=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/androidWaitlist.jsView on unpkg1"use strict";(()=>{var Vi=Object.create;var Ht=Object.defineProperty;var Bi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Ji=Object.getPrototypeOf,Gi=Object...
Findings
2 Critical8 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/androidWaitlist.js
CriticalBrowser Credential Phishingdist/androidWaitlist.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
MediumSecret Patterndist/granolaSwitch.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.7.13.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.7.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.