@upsnap/strapi@1.0.16

One or more suspicious static signals were detected.

Strapi admin plugin initialization

Discloses administrator identity/contact details, site URL, IP/geolocation, and device/runtime metadata.

automatic PII and environment telemetry exfiltration

The registered admin initializer automatically posts browser, OS, language, screen size, and timezone to the plugin server. Its unauthenticated handler reads the first Strapi administrator’s email, name, phone, and company, adds the site URL and IP/geolocation, then POSTs the combined record to api.upsnap.ai; this occurs without an explicit telemetry consent action.

The package implements a concrete automatic collection-and-exfiltration chain for administrator PII and deployment metadata unrelated to a user-invoked monitoring action. The lack of install hooks does not remove this runtime data-exfiltration behavior.