@xapp/contact-app@1.97.5
Booking & Contact Page for Form Widget
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete remote configuration code-execution vulnerability, but the source does not establish intentional malware or an install-time attack. It warrants a warning until dynamic evaluation is removed or the configuration is constrained to a non-executable expression language.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A visitor loads the contact page with a valid widget key.
Impact
An attacker controlling the configuration response could run JavaScript in the page origin.
Mechanism
Dynamic compilation of remotely supplied condition expressions.
AI rationale
This is a concrete remote configuration code-execution vulnerability, but the source does not establish intentional malware or an install-time attack. It warrants a warning until dynamic evaluation is removed or the configuration is constrained to a non-executable expression language.
Evidence
src/App.tsxdist/index.jsdist/index.es.jsdist/xapp-contact-page.js
Network endpoints1
form.xapp.ai
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The app downloads and parses widget configuration at runtime.
- Each distributed bundle compiles configuration-supplied field conditions with new Function.
- A compromised configuration response can execute JavaScript in the contact page's origin.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The child-process call is confined to the build-only Rollup configuration.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggedrollup.config.jsView file
22import replace from "rollup-plugin-replace";
L23: import { execSync } from "child_process";
L24:
High
dist/xapp-contact-page.jsView file
323}
L324: `:null,TZ=(0,bZ.styled)("span",{name:"MuiSkeleton",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:n}=e;return[t.root,t[n.variant],!1!==n.animation&&t[n.animation],n.hasChil...
L325: /*! Copyright (c) 2025, XAPP AI */function R0(e,t){var n=e.slice(0,5);return!!t.find(function(e){if(e===n)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/xapp-contact-page.jsView on unpkg · L323193contains invisible/control Unicode U+2066 (left-to-right isolate)
function(e){var t=Sb.default,n=xb.default;Object.defineProperty(e,"__esModule",{value:!0});var r={chainPropTypes:!0,deepmerge:!0,isPlainObject:!0,elementAcceptingRef:!0,elementTypeAcceptingRef:!0,exactProp:!0,formatMuiErrorMessage:!0,getDis
Findings
4 Critical4 High3 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
CriticalRemote Asset Decode Executedist/xapp-contact-page.js
CriticalTrojan Source Unicodedist/xapp-contact-page.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processrollup.config.js
HighShell
HighEvaldist/xapp-contact-page.js
HighSame File Env Network Executiondist/xapp-contact-page.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/contact-app@1.97.5.
See all versions of @xapp/contact-app for other recorded verdicts.
- Review the evidence and your use of @xapp/contact-app@1.97.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.