@thoughtspot/visual-embed-sdk@1.53.0
ThoughtSpot Embed SDK
AI Security Review
scanned 23h ago · by lpm-firewall-aiThe package’s authentication requests send credentials to the caller-provided ThoughtSpot host, consistent with its purpose. However, runtime Mixpanel analytics also identifies non-public users and registers the embedding host without a visible consent or opt-out check, which meets the suspicious telemetry criteria.
Decision evidence
public snapshot- Runtime Mixpanel initialization identifies non-public users with the session’s userGUID.
- Mixpanel registers the embedding host and ThoughtSpot cluster metadata.
- Authentication and rendering trigger session setup and runtime telemetry.
- Authentication tokens are sent to the caller-provided ThoughtSpot host.
- The package describes itself as a ThoughtSpot embedding SDK, and its token requests target the configured ThoughtSpot host.
- The declared lifecycle scripts are prepare and prepublishOnly; neither is an install or postinstall hook.
Source & flagged code
3 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
cjs/src/embed/liveboard.js#virtual:normalized:round1View on unpkgTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @thoughtspot/visual-embed-sdk@1.53.0.
See all versions of @thoughtspot/visual-embed-sdk for other recorded verdicts.
- Review the evidence and your use of @thoughtspot/visual-embed-sdk@1.53.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.