@tuix/widget
Element-anchored feedback for web applications
This report shows the evidence for @tuix/widget@0.3.1. 0 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package’s report and account features are consistent with its feedback-widget purpose, and no account hijack behavior was established. However, it sends undisclosed runtime telemetry by default, so this warrants a warning rather than a clean verdict or publication block.
Decision evidence
public snapshot- Runtime telemetry posts widget load and submission durations, plus coarse error categories, to the Tuix API.
- Telemetry is enabled by default unless the widget configuration sets telemetry to false.
- The README says API requests begin after the widget is opened, but does not disclose runtime telemetry.
- The package has no install, preinstall, or postinstall scripts.
- The widget’s report submission and account preference actions are part of its feedback interface.
Source & flagged code
5 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/core-_uO7011-.jsView on unpkg · L1Runtime telemetry posts widget load and submission durations, plus coarse error categories, to the Tuix API.
dist/core-_uO7011-.jsView on unpkg · L2Findings
Affected versions and remediation
This report applies to @tuix/widget@0.3.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @tuix/widget@0.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.