registry / @tanay-wispr/webflow-package / 6.8.14
@tanay-wispr/webflow-package@6.8.14
Developer starter template for Finsweet projects.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe scanner's credential and phishing indicators match product signup, account, waitlist, and download flows in the inspected bundles; their observed recipients are the product API or Supabase service. No concrete attack behavior was found, and the manifest shows no install hook.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A site visitor signs up, checks an account or subscription, or submits a download or waitlist form.
Impact
No confirmed unauthorized account action, credential collection for an unrelated recipient, or other attack effect was established.
Mechanism
The bundles send form data or account tokens to product API routes, and the Android waitlist bundle configures the product's Supabase service.
AI rationale
The scanner's credential and phishing indicators match product signup, account, waitlist, and download flows in the inspected bundles; their observed recipients are the product API or Supabase service. No concrete attack behavior was found, and the manifest shows no install hook.
Evidence
package.jsondist/downloads.jsdist/desktopAuth.jsdist/global.jsdist/login.jsdist/pricing.jsdist/signup.jsdist/web-demo/index.jsdist/androidWaitlist.jsdist/calculator-business.jsdist/calculator.js.lpm-dependency-evidence-79029b87-1d24-4d8c-9cfd-df102d7db50f/0/npm-linux/package.json.lpm-dependency-evidence-79029b87-1d24-4d8c-9cfd-df102d7db50f/0/npm-linux/dist/index.js.lpm-dependency-evidence-79029b87-1d24-4d8c-9cfd-df102d7db50f/1/npm-linux/package.json.lpm-dependency-evidence-79029b87-1d24-4d8c-9cfd-df102d7db50f/1/npm-linux/dist/index.mjs.lpm-dependency-evidence-79029b87-1d24-4d8c-9cfd-df102d7db50f/1/npm-linux/dist/index.cjs
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to src/index.ts and lists only development, build, and maintenance scripts; no install lifecycle hook is present. The flagged bundles are in dist.
- The reviewed bundles send authentication data, account tokens, and signup data to api.wisprflow.ai for product authentication, subscription, promo, and referral operations.
- The download form sends the entered email and selected platform to the product API; the Android waitlist bundle configures Supabase at dodjkfqhwrzqjwkfnthl.supabase.co.
- Inspected dependency snapshots show utility exports, Supabase SDK entrypoints, and no install scripts in the cited manifests.
Evidence against
- Authentication tokens and signup data are handled by the bundles, but the inspected requests use product API endpoints and product operations.
- The Android waitlist bundle includes a Supabase project URL and key; the reviewed source does not show browser password collection or an unrelated credential recipient.
Behavioral surface
NetworkWebSocket
Source & flagged code
7 flaggeddist/downloads.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
dist/androidWaitlist.jsView file
•Browser cookie sent to a fixed external endpoint in dist/androidWaitlist.js:
"use strict";(()=>{var Gi=Object.create;var Vt=Object.defineProperty;var Ki=Object.getOwnPropertyDescriptor;var Yi=Object.getOwnPropertyNames;var Xi=Object.getPrototypeOf,Qi=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/androidWaitlist.jsView on unpkg1"use strict";(()=>{var Gi=Object.create;var Vt=Object.defineProperty;var Ki=Object.getOwnPropertyDescriptor;var Yi=Object.getOwnPropertyNames;var Xi=Object.getPrototypeOf,Qi=Object...
Findings
2 Critical7 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/androidWaitlist.js
CriticalBrowser Credential Phishingdist/androidWaitlist.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.8.14.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.8.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.