@xapp/form-widget
Form Widget
This report shows the evidence for @xapp/form-widget@1.119.0. 0 of 33 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe widget automatically sends partial form answers on abandonment, which creates a privacy-sensitive runtime telemetry risk without an evident opt-in. The receiver comes from the embedding app’s configured server, and the inspected code does not show credential theft or an unrelated collector, so this merits a warning rather than a block.
Decision evidence
public snapshot- On widget close, the code includes `partialData` in a `partial_data` event.
- On tab close, the code sends current partial form data with a `close_tab` abandonment reason.
- The event beacon posts to `/cms/widget/events` on the origin of the configured API URL.
- The embedded widget obtains that API URL from `connection.serverUrl`.
- The `prepare` script runs the package build.
- The receiver is selected through the embedding app’s configuration; the inspected event path does not show a separate hard-coded collector.
- The package is a form widget, and the partial data is sent as form abandonment tracking.
- No credential harvesting, shell execution, or unrelated host transfer was identified in the inspected paths.
Source & flagged code
5 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1Package source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @xapp/form-widget@1.119.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @xapp/form-widget@1.119.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.