@tuix/widget@0.3.1
Element-anchored feedback for web applications
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package’s report and account features are consistent with its feedback-widget purpose, and no account hijack behavior was established. However, it sends undisclosed runtime telemetry by default, so this warrants a warning rather than a clean verdict or publication block.
Static reason
No blocking static signals were detected.
Trigger
A user opens the widget; telemetry is enabled by default.
Impact
The API receives usage and error measurements without clear README disclosure; the reviewed telemetry payloads do not show credentials or page contents.
Mechanism
The widget posts load and submission timings and coarse error categories to its telemetry endpoint. Configuration can disable telemetry.
AI rationale
The package’s report and account features are consistent with its feedback-widget purpose, and no account hijack behavior was established. However, it sends undisclosed runtime telemetry by default, so this warrants a warning rather than a clean verdict or publication block.
Evidence
dist/core-_uO7011-.jsREADME.md
Network endpoints1
api.tuix.app
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime telemetry posts widget load and submission durations, plus coarse error categories, to the Tuix API.
- Telemetry is enabled by default unless the widget configuration sets telemetry to false.
- The README says API requests begin after the widget is opened, but does not disclose runtime telemetry.
Evidence against
- The package has no install, preinstall, or postinstall scripts.
- The widget’s report submission and account preference actions are part of its feedback interface.
Behavioral surface
Network
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/core-_uO7011-.jsView file
1import{A as e,C as t,D as n,E as r,O as i,S as a,T as o,_ as s,a as c,b as l,c as u,g as d,h as f,i as p,j as m,k as h,l as g,m as _,o as v,p as y,s as ee,u as b,v as te,w as ne,x ...
L2: `),()=>this.ontimeout(),t=>{!t||t.status!==200?this.closeAndRetry(t&&t.status,1011,`internal server error`,!1):n<e.length?this.batchSend(e,n):this.batchBuffer.length>0?(this.batchS...
L3: `)[0],status:`sending`,type:W.type,severity:W.severity,env_name:D.environment,url:W.url,route_key:W.route,locators:W.locators,author:{name:oe.name},comment_count:0,inserted_at:new ...
L4: `).trim(),h=p?s:`${s} ${r.title}`,v=[p?`${s} ${p.replace(/\n/g,` `)}`:h,c,f,e.orphan&&m.moved,o&&m.unreadUpdates,i&&`${u}: ${i.body}`,!p&&i===null&&m.noReplies].filter(Boolean).joi...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/core-_uO7011-.jsView on unpkg · L12e.request(`/telemetry/runtime`,`POST`,t).catch(()=>{})}function u(){t&&r&&!i&&a!==void 0&&(i=!0,n&&l({kind:`load`,duration_ms:a}))}function d(){t&&r&&!o&&s!==void 0&&(o=!0,n&&l({ki
Medium
Ai Review Evidence
Runtime telemetry posts widget load and submission durations, plus coarse error categories, to the Tuix API.
dist/core-_uO7011-.jsView on unpkg · L2Findings
1 High5 Medium3 Low
HighBrowser Session Account Hijackdist/core-_uO7011-.js
MediumNetwork
MediumAi Review Evidencedist/core-_uO7011-.js
MediumAi Review Evidencedist/core-_uO7011-.js
MediumAi Review Evidencedist/core-_uO7011-.js
MediumAi Review EvidenceREADME.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tuix/widget@0.3.1.
See all versions of @tuix/widget for other recorded verdicts.
- Review the evidence and your use of @tuix/widget@0.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.