registry / @vouchfor/embeds / 8.7.0
@vouchfor/embeds@8.7.0
⚠ Under reviewAI Security Review
scanned 8d ago · by lpm-firewall-aiThe package manifest shows no install hook, and the `prepublishOnly` script runs a build. Two first-party runtime dependencies could not be resolved, so their behavior remains unverified and a clean verdict is not supported.
Static reason
No blocking static signals were detected.
Trigger
Importing the package entrypoint loads the two unresolved dependencies.
Impact
No attack impact is confirmed; the unresolved dependency behavior prevents a clean determination.
Mechanism
The package imports the dependencies, but their source was unavailable for inspection, so their runtime behavior could not be verified.
AI rationale
The package manifest shows no install hook, and the `prepublishOnly` script runs a build. Two first-party runtime dependencies could not be resolved, so their behavior remains unverified and a clean verdict is not supported.
Evidence
package.jsondist/es/embeds.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest lists a `prepublishOnly` build step, with no `preinstall`, `install`, or `postinstall` hook shown.
- The runtime manifest declares `@vouchfor/canvas-video` and `@vouchfor/media-player` as dependencies; the package entrypoint imports both.
- Those first-party runtime dependencies could not be resolved in the supplied source snapshot, leaving their behavior unverified.
Evidence against
- The inspected manifest does not show an install-time lifecycle hook; `prepublishOnly` runs the build step.
Behavioral surface
EvalNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/iife/embeds.iife.jsView file
68`+R.split(/\n/)[Y-1]+`
L69: `+Array(ie).join(" ")+"^")}r.prototype=Object.create(Error.prototype,{name:{value:"Squirrelly Error",enumerable:!1}});var s=new Function("return this")().Promise,o=!1;try{o=new Fun...
L70: `).replace(/^\s+|\s+$/gm,"")),u.lastIndex=0,A.lastIndex=0,h.lastIndex=0;var F=R.prefixes,j=[F.h,F.b,F.i,F.r,F.c,F.e].reduce(function(pe,Me){return pe&&Me?pe+"|"+f(Me):Me?f(Me):pe},...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/iife/embeds.iife.jsView on unpkg · L68package.jsonView file
32"prepublishOnly": "yarn build",
"size": "size-limit",
"storybook": "yarn prebuild && storybook dev -p 6007",
Low
Suspicious Lifecycle Evidence
The manifest lists a `prepublishOnly` build step, with no `preinstall`, `install`, or `postinstall` hook shown.
package.jsonView on unpkg · L3245"dependencies": {
"@a11y/focus-trap": "^1.0.5",
"@lit/task": "^1.0.2",
"@vouchfor/canvas-video": "^13.7.0",
"@vouchfor/media-player": "^9.7.0",
"uuid": "^9.0.1"
},
Findings
1 Medium9 Low
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/iife/embeds.iife.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencedist/es/embeds.js
Affected versions and remediation
This report applies to @vouchfor/embeds@8.7.0.
See all versions of @vouchfor/embeds for other recorded verdicts.
- Review the evidence and your use of @vouchfor/embeds@8.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.