@xapp/contact-app@1.100.1
Booking & Contact Page for Form Widget
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically reports incomplete form data and visitor metadata when a form is abandoned, without a visible consent prompt or opt-out in the inspected path. The destination is the configured widget API and fits the package’s purpose, so this merits a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A form is incomplete when the user closes or navigates away from the page; related code also sends abandonment data when the page becomes hidden.
Impact
The widget service receives entered form values and metadata such as the browser user agent, user ID, page URL, and attribution parameters without an explicit form submission.
Mechanism
The main bundle builds a `partial_data` event and POSTs it with the widget key to `/cms/widget/events` on the configured API origin.
AI rationale
The package automatically reports incomplete form data and visitor metadata when a form is abandoned, without a visible consent prompt or opt-out in the inspected path. The destination is the configured widget API and fits the package’s purpose, so this merits a warning rather than a malicious verdict.
Evidence
dist/index.jsdist/index.es.js
Network endpoints1
api.xapp.ai/cms/widget/events (configured API origin)
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package’s main bundle creates a `partial_data` event containing form data and sends it through event tracking.
- An incomplete form automatically records that data on `beforeunload`, with `close_tab` as the abandonment reason.
- Event tracking POSTs the event with the widget key to `/cms/widget/events` on the configured API origin.
- Tracking metadata includes the browser user agent, stored user ID, page URL, and stored attribution parameters.
Evidence against
- The package describes itself as a booking and contact form widget, so communicating with its service supports its stated purpose.
- There are no install or postinstall lifecycle scripts in the package metadata.
- The event destination is derived from the configured API origin; the inspected code does not send this event to an unrelated collector.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedrollup.config.jsView file
22import replace from "rollup-plugin-replace";
L23: import { execSync } from "child_process";
L24:
High
dist/xapp-contact-page.jsView file
193contains invisible/control Unicode U+2066 (left-to-right isolate)
function(e){var t=jb.default,n=wb.default;Object.defineProperty(e,"__esModule",{value:!0});var r={chainPropTypes:!0,deepmerge:!0,isPlainObject:!0,elementAcceptingRef:!0,elementTypeAcceptingRef:!0,exactProp:!0,formatMuiErrorMessage:!0,getDis
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/xapp-contact-page.jsView on unpkg · L193323}
L324: `:null,CZ=(0,xZ.styled)("span",{name:"MuiSkeleton",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:n}=e;return[t.root,t[n.variant],!1!==n.animation&&t[n.animation],n.hasChil...
L325: /*! Copyright (c) 2025, XAPP AI */function R0(e,t){var n=e.slice(0,5);return!!t.find(function(e){if(e===n)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
2 Critical3 High3 Medium4 Low
CriticalTrojan Source Unicodedist/xapp-contact-page.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processrollup.config.js
HighShell
HighSame File Env Network Executiondist/xapp-contact-page.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/xapp-contact-page.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/contact-app@1.100.1.
See all versions of @xapp/contact-app for other recorded verdicts.
- Review the evidence and your use of @xapp/contact-app@1.100.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.