registry / @tanay-wispr/webflow-package / 6.8.10
@tanay-wispr/webflow-package@6.8.10
Developer starter template for Finsweet projects.
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection found no malicious behavior: the flagged bundle’s account and promo requests target the package’s Wispr Flow API, and the manifest contains no lifecycle hook. Scanner claims of credential exfiltration were not supported by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A site using the bundled frontend invokes signup, email authentication, or promo application.
Impact
No unrelated credential transfer, install-time action, or other confirmed attack effect was established.
Mechanism
The bundle sends account form data to the Wispr Flow API; promo application uses an authorization value supplied to the helper. The inspected cookie logic concerns promo codes.
AI rationale
Source inspection found no malicious behavior: the flagged bundle’s account and promo requests target the package’s Wispr Flow API, and the manifest contains no lifecycle hook. Scanner claims of credential exfiltration were not supported by the inspected source.
Evidence
package.jsondist/androidWaitlist.js.lpm-dependency-evidence-662ec848-278a-495a-8e01-b9fcbf1bfcf3/0/npm-linux/package.json.lpm-dependency-evidence-662ec848-278a-495a-8e01-b9fcbf1bfcf3/0/npm-linux/dist/index.js.lpm-dependency-evidence-662ec848-278a-495a-8e01-b9fcbf1bfcf3/1/npm-linux/package.json.lpm-dependency-evidence-662ec848-278a-495a-8e01-b9fcbf1bfcf3/1/npm-linux/dist/index.mjs.lpm-dependency-evidence-662ec848-278a-495a-8e01-b9fcbf1bfcf3/1/npm-linux/dist/index.cjs.lpm-dependency-evidence-662ec848-278a-495a-8e01-b9fcbf1bfcf3/2/npm-linux/package.json
Network endpoints1
api.wisprflow.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install or other lifecycle hook; its scripts are development, build, lint, test, release, and update commands.
- The flagged bundle sends signup and email-authentication requests to the Wispr Flow API, consistent with its account UI.
- The bundle applies a promo code using a caller-supplied authorization value and sends it to the same Wispr Flow API.
- The reviewed dependency entrypoints expose Webflow utilities and Supabase client modules; the nookies type stub has no scripts.
- The flagged bundle’s cookie handling reads a promo cookie and removes it; no browser-password collection or unrelated credential recipient was established.
Evidence against
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/downloads.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
dist/androidWaitlist.jsView file
•Browser cookie sent to a fixed external endpoint in dist/androidWaitlist.js:
"use strict";(()=>{var Vi=Object.create;var Wt=Object.defineProperty;var Bi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Ji=Object.getPrototypeOf,Gi=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/androidWaitlist.jsView on unpkg1"use strict";(()=>{var Vi=Object.create;var Wt=Object.defineProperty;var Bi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Ji=Object.getPrototypeOf,Gi=Object...
Findings
2 Critical7 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/androidWaitlist.js
CriticalBrowser Credential Phishingdist/androidWaitlist.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.8.10.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.8.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.