registry / @xapp/contact-app / 1.94.3
@xapp/contact-app@1.94.3
Booking & Contact Page for Form Widget
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe scanner findings map to ordinary browser integrations and build-only Git metadata lookup. Direct source inspection found no install-time execution, exfiltration, destructive behavior, or malicious control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A browser renders the standalone contact page with a widget key or configured tracking/chat options.
Impact
No credential theft, filesystem access, shell execution, or stealth persistence is established.
Mechanism
Fetches XAPP configuration/branding and optionally loads customer-configured browser integrations.
AI rationale
The scanner findings map to ordinary browser integrations and build-only Git metadata lookup. Direct source inspection found no install-time execution, exfiltration, destructive behavior, or malicious control-surface mutation.
Evidence
package.jsonsrc/App.tsxsrc/services/partnerBranding.tssrc/utils/metaPixel.tssrc/index.tsxrollup.config.jsdist/index.jsdist/xapp-contact-page.js
Network endpoints4
form.xapp.ai/config.jsonapi.xapp.ai/graphqlwidget.xapp.ai/xapp-chat-widget.jsconnect.facebook.net/en_US/fbevents.js
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `src/App.tsx` fetches hosted widget configuration and conditionally loads the XAPP chat-widget script.
- `src/utils/metaPixel.ts` conditionally injects Meta Pixel after validating a configured numeric pixel ID.
Evidence against
- `package.json` has no preinstall, install, postinstall, prepare, or publish lifecycle hooks.
- `rollup.config.js` uses `execSync` only during builds to read the current Git branch.
- `src/services/partnerBranding.ts` posts only a partner code to the package-aligned GraphQL endpoint.
- No source file reads local files, harvests credentials, invokes shells at runtime, or writes persistence outside browser localStorage.
- Direct Unicode-control scan found no bidi/invisible control characters in the published bundles; the scanner Trojan Source signal is unsupported.
- Entrypoints export/render a React contact form; no import-time network, child-process, or payload execution is present.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
Source & flagged code
5 flaggedrollup.config.jsView file
22import replace from "rollup-plugin-replace";
L23: import { execSync } from "child_process";
L24:
High
dist/xapp-contact-page.jsView file
193contains invisible/control Unicode U+2066 (left-to-right isolate)
function(e){var t=sb.default,r=nb.default;Object.defineProperty(e,"__esModule",{value:!0});var n={chainPropTypes:!0,deepmerge:!0,isPlainObject:!0,elementAcceptingRef:!0,elementTypeAcceptingRef:!0,exactProp:!0,formatMuiErrorMessage:!0,getDis
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/xapp-contact-page.jsView on unpkg · L193323}
L324: `:null,cZ=(0,tZ.styled)("span",{name:"MuiSkeleton",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:r}=e;return[t.root,t[r.variant],!1!==r.animation&&t[r.animation],r.hasChil...
L325: /*! Copyright (c) 2025, XAPP AI */function s0(e,t){var r=e.slice(0,5);return!!t.find(function(e){if(e===r)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
2 Critical3 High3 Medium4 Low
CriticalTrojan Source Unicodedist/xapp-contact-page.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processrollup.config.js
HighShell
HighSame File Env Network Executiondist/xapp-contact-page.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/xapp-contact-page.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/contact-app@1.94.3.
See all versions of @xapp/contact-app for other recorded verdicts.
- Review the evidence and your use of @xapp/contact-app@1.94.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.