registry / @xapp/contact-app / 1.101.0
@xapp/contact-app@1.101.0
Booking & Contact Page for Form Widget
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found normal build and browser-component behavior, with no lifecycle hook or concrete malicious behavior. The configured service request is aligned with the package's XAPP functionality.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Normal browser use of the contact page.
Impact
No confirmed malicious impact was established.
Mechanism
No install-time execution, credential harvesting, destructive action, or remote payload execution was found.
AI rationale
Static inspection found normal build and browser-component behavior, with no lifecycle hook or concrete malicious behavior. The configured service request is aligned with the package's XAPP functionality.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines only development commands and no install lifecycle hook.
- The build configuration packages the React entrypoint and contact-page application as library outputs.
- The ES distribution exposes a contact-page component.
- The UMD distribution initializes a contact-page global rather than an install-time program.
- Branding requests use the configured XAPP GraphQL endpoint and send a partner code.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsEvalNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedrollup.config.jsView file
23import replaceStatic from "@rollup/plugin-replace";
L24: import { execSync } from "child_process";
L25:
High
dist/xapp-contact-page.jsView file
305animation: ${tX} 1.4s ease-in-out infinite;
L306: `:null,oX=RV("span",{name:"MuiCircularProgress",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:r}=e;return[t.root,t[r.variant],t[`color${bz(r.color)}`]]}})(AV(({theme:e})=>...
L307: /*! Copyright (c) 2025, XAPP AI */function mQ(e,t){var r=e.slice(0,5);return!!t.find(function(e){if(e===r)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/xapp-contact-page.jsView on unpkg · L305305animation: ${tX} 1.4s ease-in-out infinite;
L306: `:null,oX=RV("span",{name:"MuiCircularProgress",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:r}=e;return[t.root,t[r.variant],t[`color${bz(r.color)}`]]}})(AV(({theme:e})=>...
L307: /*! Copyright (c) 2025, XAPP AI */function mQ(e,t){var r=e.slice(0,5);return!!t.find(function(e){if(e===r)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
HighChild Processrollup.config.js
HighShell
HighSame File Env Network Executiondist/xapp-contact-page.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/xapp-contact-page.js
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @xapp/contact-app@1.101.0.
See all versions of @xapp/contact-app for other recorded verdicts.
- Review the evidence and your use of @xapp/contact-app@1.101.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.