registry / @xapp/contact-app / 1.99.4
@xapp/contact-app@1.99.4
Booking & Contact Page for Form Widget
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe source matches a contact page library: it fetches configuration from XAPP endpoints, and third-party pixel tracking is initialized only when customer configuration supplies an ID. The scanner’s execution and Unicode flags resolve to build-time Git branch lookup, configured form conditions, and MUI date formatting; no attack chain was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The consumer imports the library or renders the contact page; network requests and optional pixels occur when the page loads with customer configuration.
Impact
Observed behavior supports the contact form, branding, and customer-selected conversion tracking; no unrelated collection or execution behavior was identified.
Mechanism
The app fetches form configuration and partner branding from XAPP endpoints. It can load customer-configured Meta or OpenAI pixels and compile configured form conditions.
AI rationale
The source matches a contact page library: it fetches configuration from XAPP endpoints, and third-party pixel tracking is initialized only when customer configuration supplies an ID. The scanner’s execution and Unicode flags resolve to build-time Git branch lookup, configured form conditions, and MUI date formatting; no attack chain was found.
Evidence
src/App.tsxsrc/config/endpoints.tssrc/utils/metaPixel.tssrc/utils/openAiPixel.tsrollup.config.jsdist/index.jsdist/xapp-contact-page.js
Network endpoints6
api.xapp.ai/graphqlform.xapp.aidev-api.xapp.media/graphqldev-widget.xapp.mediaconnect.facebook.net/en_US/fbevents.jsbzrcdn.openai.com/sdk/oaiq.min.js
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package’s main and module entries are library bundles; its npm scripts contain no install lifecycle hook.
- The app fetches widget configuration from its configured XAPP form endpoint and uses XAPP API endpoints for the documented features.
- Meta and OpenAI pixels initialize from customer configuration; their events are page views and form leads, and initialization checks the browser’s Global Privacy Control signal.
- Dynamic Function calls compile configured form field and step conditions; no shell execution appears in the published bundle.
- The build configuration runs git rev-parse to read the branch for build replacement; this is build-time behavior.
- The bidi isolation characters flagged in the bundle occur in MUI date formatting; no review-directed override was identified.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsEvalNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedrollup.config.jsView file
22import replace from "rollup-plugin-replace";
L23: import { execSync } from "child_process";
L24:
High
dist/xapp-contact-page.jsView file
193contains invisible/control Unicode U+2066 (left-to-right isolate)
function(e){var t=jb.default,n=wb.default;Object.defineProperty(e,"__esModule",{value:!0});var r={chainPropTypes:!0,deepmerge:!0,isPlainObject:!0,elementAcceptingRef:!0,elementTypeAcceptingRef:!0,exactProp:!0,formatMuiErrorMessage:!0,getDis
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/xapp-contact-page.jsView on unpkg · L193323}
L324: `:null,CZ=(0,xZ.styled)("span",{name:"MuiSkeleton",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:n}=e;return[t.root,t[n.variant],!1!==n.animation&&t[n.animation],n.hasChil...
L325: /*! Copyright (c) 2025, XAPP AI */function R0(e,t){var n=e.slice(0,5);return!!t.find(function(e){if(e===n)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
2 Critical3 High3 Medium4 Low
CriticalTrojan Source Unicodedist/xapp-contact-page.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processrollup.config.js
HighShell
HighSame File Env Network Executiondist/xapp-contact-page.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/xapp-contact-page.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/contact-app@1.99.4.
See all versions of @xapp/contact-app for other recorded verdicts.
- Review the evidence and your use of @xapp/contact-app@1.99.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.