registry / @tanay-wispr/webflow-package / 6.8.2
@tanay-wispr/webflow-package@6.8.2
Developer starter template for Finsweet projects.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe flagged credential and data transfers match the package's browser authentication and waitlist functionality, with fixed service destinations and user-driven submissions. Source inspection did not substantiate the scanner's phishing or malicious exfiltration claims.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Browser loading and Webflow callbacks activate page features; form submissions and file selection activate user submissions.
Impact
The inspected behavior supports account and marketing features; no covert credential theft or malicious install behavior was established.
Mechanism
Requests use service-related endpoints, with waitlist credentials sent to the fixed Wispr API and screenshots selected by the user.
AI rationale
The flagged credential and data transfers match the package's browser authentication and waitlist functionality, with fixed service destinations and user-driven submissions. Source inspection did not substantiate the scanner's phishing or malicious exfiltration claims.
Network endpoints3
api.wisprflow.aidodjkfqhwrzqjwkfnthl.supabase.coapi.workos.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has development scripts but no automatic install lifecycle hooks or runtime self-dependency; its source entrypoint is absent from the snapshot.
- The waitlist API destination is fixed to api.wisprflow.ai, and phone submissions use its authenticated waitlist endpoint.
- Password authentication posts to the same Wispr API rather than an unrelated receiver.
- Screenshot uploads start from a user-selected file input and support the waitlist sharing feature.
- Download analytics send account and attribution data to a fixed Wispr tracking endpoint.
- Desktop authentication uses the Wispr web-to-desktop endpoint and application protocol.
Evidence against
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/downloads.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
dist/androidWaitlist.jsView file
•Browser cookie sent to a fixed external endpoint in dist/androidWaitlist.js:
"use strict";(()=>{var Vi=Object.create;var Ht=Object.defineProperty;var Bi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Ji=Object.getPrototypeOf,Gi=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/androidWaitlist.jsView on unpkg1"use strict";(()=>{var Vi=Object.create;var Ht=Object.defineProperty;var Bi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Ji=Object.getPrototypeOf,Gi=Object...
Findings
2 Critical7 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/androidWaitlist.js
CriticalBrowser Credential Phishingdist/androidWaitlist.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.8.2.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.