registry / @tanay-wispr/webflow-package / 6.8.13
@tanay-wispr/webflow-package@6.8.13
Developer starter template for Finsweet projects.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe scanner’s credential and Supabase indicators match application authentication, payment, and waitlist requests directed to the configured services. The manifest has no install lifecycle hook, and the inspected source establishes no unrelated credential recipient or concrete attack behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes an authentication, payment, demo, or waitlist feature in the browser.
Impact
No unrelated credential disclosure or other concrete attack impact was established.
Mechanism
The bundles send feature requests to api.wisprflow.ai and configure a Supabase client for the Android waitlist.
AI rationale
The scanner’s credential and Supabase indicators match application authentication, payment, and waitlist requests directed to the configured services. The manifest has no install lifecycle hook, and the inspected source establishes no unrelated credential recipient or concrete attack behavior.
Evidence
package.jsondist/downloads.jsdist/desktopAuth.jsdist/global.jsdist/login.jsdist/pricing.jsdist/signup.jsdist/web-demo/index.jsdist/androidWaitlist.jsdist/calculator-business.jsdist/calculator.js
Network endpoints2
api.wisprflow.aidodjkfqhwrzqjwkfnthl.supabase.co
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the package entrypoint and publishes dist; its scripts contain no install lifecycle hook.
- The reviewed bundles send authentication and payment requests to api.wisprflow.ai, including account credentials in authorization headers for subscription, checkout, promo, and referral functions.
- The Android waitlist bundle configures the Supabase client for the waitlist feature; inspected dependency entrypoints and manifests identify utility, Supabase, and type packages.
- The reviewed demo requests a token from api.wisprflow.ai; no unrelated credential recipient or concrete attack was identified.
Evidence against
- Scanner labels flagged credential handling and a Supabase host, but inspected code directs these requests to the application API or waitlist service.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/downloads.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
dist/androidWaitlist.jsView file
•Browser cookie sent to a fixed external endpoint in dist/androidWaitlist.js:
"use strict";(()=>{var Gi=Object.create;var Vt=Object.defineProperty;var Ki=Object.getOwnPropertyDescriptor;var Yi=Object.getOwnPropertyNames;var Xi=Object.getPrototypeOf,Qi=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/androidWaitlist.jsView on unpkg1"use strict";(()=>{var Gi=Object.create;var Vt=Object.defineProperty;var Ki=Object.getOwnPropertyDescriptor;var Yi=Object.getOwnPropertyNames;var Xi=Object.getPrototypeOf,Qi=Object...
Findings
2 Critical7 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/androidWaitlist.js
CriticalBrowser Credential Phishingdist/androidWaitlist.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.8.13.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.8.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.