registry / @tanay-wispr/webflow-package / 6.8.5
@tanay-wispr/webflow-package@6.8.5
Developer starter template for Finsweet projects.
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection supports ordinary browser authentication and signup behavior routed to the product service. No install hook or separate credential destination was established, so the scanner's exfiltration hint is not substantiated.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consuming site loads a browser bundle and a user submits signup or sign-in data.
Impact
No separate credential recipient or confirmed attack surface was established.
Mechanism
The bundle sends signup input to the Wispr API and password sign-in input to its configured authentication service.
AI rationale
Source inspection supports ordinary browser authentication and signup behavior routed to the product service. No install hook or separate credential destination was established, so the scanner's exfiltration hint is not substantiated.
Network endpoints1
api.wisprflow.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a browser entry point and packages the dist directory.
- Signup data is posted to the configured Wispr API base URL.
- Password sign-in sends the supplied email and password to the configured authentication service.
Evidence against
- Inspected signup and sign-in flows use product service URLs; no separate credential recipient was established.
- The manifest defines no install lifecycle hook.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/downloads.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
dist/androidWaitlist.jsView file
•Browser cookie sent to a fixed external endpoint in dist/androidWaitlist.js:
"use strict";(()=>{var Vi=Object.create;var Ht=Object.defineProperty;var Bi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Ji=Object.getPrototypeOf,Gi=Object...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/androidWaitlist.jsView on unpkg1"use strict";(()=>{var Vi=Object.create;var Ht=Object.defineProperty;var Bi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Ji=Object.getPrototypeOf,Gi=Object...
Findings
2 Critical7 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/androidWaitlist.js
CriticalBrowser Credential Phishingdist/androidWaitlist.js
MediumSecret Patterndist/downloads.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/desktopAuth.js
MediumSecret Patterndist/signup.js
MediumSecret Patterndist/login.js
MediumSecret Patterndist/androidWaitlist.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tanay-wispr/webflow-package@6.8.5.
See all versions of @tanay-wispr/webflow-package for other recorded verdicts.
- Review the evidence and your use of @tanay-wispr/webflow-package@6.8.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.