registry / @xapp/contact-app / 1.101.3
@xapp/contact-app@1.101.3
Booking & Contact Page for Form Widget
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe alleged hardcoded exfiltration resolves to a configurable form client authenticating to its supplied API destination, with tracking bound to that origin. Build commands and dynamic functions have identifiable package-related purposes, and inspected source does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Rendering and using the configured contact form activates its API requests; no automatic install hook exists.
Impact
The inspected code supports normal form submission and analytics; no credential theft, destructive mutation, or malicious persistence was established.
Mechanism
The widget sends form requests using the API URL and key supplied together in its configuration, and derives tracking requests from that API origin.
AI rationale
The alleged hardcoded exfiltration resolves to a configurable form client authenticating to its supplied API destination, with tracking bound to that origin. Build commands and dynamic functions have identifiable package-related purposes, and inspected source does not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has development scripts but no automatic install lifecycle hooks or runtime self-dependency.
- rollup.config.js runs a fixed Git branch query during builds.
- The form client receives its API URL and key from the supplied widget configuration and uses that key to authenticate requests to that URL.
- dist/xapp-contact-page.js derives the tracking destination from the configured API origin.
- The flagged dynamic function retrieves the global object; other dynamic functions evaluate configured form conditions.
- The exported contact page passes caller-supplied configuration to the form widget.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsEvalNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedrollup.config.jsView file
23import replaceStatic from "@rollup/plugin-replace";
L24: import { execSync } from "child_process";
L25:
High
dist/xapp-contact-page.jsView file
305animation: ${eX} 1.4s ease-in-out infinite;
L306: `:null,nX=EV("span",{name:"MuiCircularProgress",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:r}=e;return[t.root,t[r.variant],t[`color${vz(r.color)}`]]}})(RV(({theme:e})=>...
L307: /*! Copyright (c) 2025, XAPP AI */function fQ(e,t){var r=e.slice(0,5);return!!t.find(function(e){if(e===r)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/xapp-contact-page.jsView on unpkg · L305305animation: ${eX} 1.4s ease-in-out infinite;
L306: `:null,nX=EV("span",{name:"MuiCircularProgress",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:r}=e;return[t.root,t[r.variant],t[`color${vz(r.color)}`]]}})(RV(({theme:e})=>...
L307: /*! Copyright (c) 2025, XAPP AI */function fQ(e,t){var r=e.slice(0,5);return!!t.find(function(e){if(e===r)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
HighChild Processrollup.config.js
HighShell
HighSame File Env Network Executiondist/xapp-contact-page.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/xapp-contact-page.js
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @xapp/contact-app@1.101.3.
See all versions of @xapp/contact-app for other recorded verdicts.
- Review the evidence and your use of @xapp/contact-app@1.101.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.