@xapp/contact-app@1.101.9
Booking & Contact Page for Form Widget
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe runtime function-construction path is a concrete dangerous capability, but the inspected source does not show that an attacker can control the fetched conditions or that the package uses it maliciously. No install lifecycle hook or confirmed attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A widget loads configuration containing a conditional form field or step.
Impact
Potential browser-side code execution and access to page data, conditional on an attacker controlling the fetched condition.
Mechanism
The bundle turns the condition expression into a function and evaluates it against form context; the source does not establish that this expression is safely constrained.
AI rationale
The runtime function-construction path is a concrete dangerous capability, but the inspected source does not show that an attacker can control the fetched conditions or that the package uses it maliciously. No install lifecycle hook or confirmed attack behavior was found.
Evidence
src/App.tsxsrc/config/endpoints.tsdist/index.es.js
Network endpoints1
form.xapp.ai
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes browser bundles and declares no install lifecycle hook; this risk is in runtime form-condition handling.
- The app fetches and parses widget configuration from its configured form service.
- The published bundle compiles configured field conditions with a function constructor and evaluates them against form context. Its identifier rewriting does not establish that expressions are safe.
Evidence against
- Inspected source shows no confirmed malicious condition, credential theft, or install-time attack; exploitation depends on an untrusted party being able to control the fetched configuration.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedrollup.config.jsView file
23import replaceStatic from "@rollup/plugin-replace";
L24: import { execSync } from "child_process";
L25:
High
dist/xapp-contact-page.jsView file
1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa...
L2: /*! Copyright (c) 2025, XAPP AI */function Wr(e,t){var n=e.slice(0,5);return!!t.find(function(e){if(e===n)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/xapp-contact-page.jsView on unpkg · L11!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa...
L2: /*! Copyright (c) 2025, XAPP AI */function Wr(e,t){var n=e.slice(0,5);return!!t.find(function(e){if(e===n)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
1 Critical3 High4 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
HighChild Processrollup.config.js
HighShell
HighSame File Env Network Executiondist/xapp-contact-page.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowEvaldist/xapp-contact-page.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/contact-app@1.101.9.
See all versions of @xapp/contact-app for other recorded verdicts.
- Review the evidence and your use of @xapp/contact-app@1.101.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.