registry / @tanay-wispr/webflow-package / 6.7.6
@tanay-wispr/webflow-package@6.7.6
Developer starter template for Finsweet projects.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no registry lifecycle hook and its flagged network code is a Webflow page bundle. The observed upload is tied to a user-selected screenshot and does not establish hidden exfiltration or npm install abuse.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A website loads the Android waitlist bundle and a user interacts with its page controls.
Impact
No install-time, import-time Node, persistence, or unconsented local-data attack was found.
Mechanism
User-driven browser API requests for waitlist and social-share verification.
AI rationale
The package has no registry lifecycle hook and its flagged network code is a Webflow page bundle. The observed upload is tied to a user-selected screenshot and does not establish hidden exfiltration or npm install abuse.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has development scripts but no preinstall, install, or postinstall hook.
- The Android waitlist bundle can upload a screenshot to the Wispr Flow API with the current authorization token.
- The bundle is initialized through Webflow's browser-page queue.
Evidence against
- No install-time execution, self-dependency, shell execution, native loading, or project-file mutation was found.
- The screenshot request is made from a user file-input change handler for social-share verification, not from package installation.
- The network behavior is website authentication, waitlist, and analytics functionality rather than a hidden npm-runtime action.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/downloads.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
dist/androidWaitlist.jsView file
•Browser cookie sent to a fixed external endpoint in dist/androidWaitlist.js:
"use strict";(()=>{var qi=Object.create;var Ht=Object.defineProperty;var Di=Object.getOwnPropertyDescriptor;var Fi=Object.getOwnPropertyNames;var Hi=Object.getPrototypeOf,Wi=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/androidWaitlist.jsView on unpkg1patternName = generic_password
severity = medium
line = 1
Medium
Findings
1 Critical7 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/androidWaitlist.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.7.6.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.7.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.