registry / @tanay-wispr/webflow-package / 6.8.11
@tanay-wispr/webflow-package@6.8.11
Developer starter template for Finsweet projects.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe scanner’s credential findings resolve to application authentication and payment calls directed to the package’s service API. The manifest and inspected dependencies show no install-time behavior that establishes an attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user loads the relevant site bundle and invokes its login, signup, payment, or promo feature.
Impact
No unauthorized credential transfer or other attack impact was identified.
Mechanism
The inspected calls send supplied authorization values to Wispr Flow API routes; the manifest declares no install lifecycle hook.
AI rationale
The scanner’s credential findings resolve to application authentication and payment calls directed to the package’s service API. The manifest and inspected dependencies show no install-time behavior that establishes an attack.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to a source entry and lists build and development scripts, with no install lifecycle hook.
- The inspected payment and promo calls send supplied authorization values to fixed Wispr Flow API routes for subscription, checkout, promo, and waitlist features.
- The flagged bundles contain site login and signup flows, while the demo requests a token from the Wispr Flow API for its Webflow demo client.
- The inspected dependencies are Webflow utilities, the Supabase SDK, and type definitions; their manifests show ordinary development scripts and no postinstall hook.
Evidence against
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/downloads.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
dist/androidWaitlist.jsView file
•Browser cookie sent to a fixed external endpoint in dist/androidWaitlist.js:
"use strict";(()=>{var Gi=Object.create;var Vt=Object.defineProperty;var Ki=Object.getOwnPropertyDescriptor;var Yi=Object.getOwnPropertyNames;var Xi=Object.getPrototypeOf,Qi=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/androidWaitlist.jsView on unpkg1"use strict";(()=>{var Gi=Object.create;var Vt=Object.defineProperty;var Ki=Object.getOwnPropertyDescriptor;var Yi=Object.getOwnPropertyNames;var Xi=Object.getPrototypeOf,Qi=Object...
Findings
2 Critical7 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/androidWaitlist.js
CriticalBrowser Credential Phishingdist/androidWaitlist.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.8.11.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.8.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.