registry / @xapp/form-widget / 1.104.0
@xapp/form-widget@1.104.0
Form Widget
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected entrypoints show package-aligned form behavior, with caller-configured authentication and integrations. Static inspection found no concrete malicious installation, credential theft, or agent control mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the widget adds styles; rendering configured forms activates requests and integrations.
Impact
The widget stores browser tracking state and transmits form and attribution data as part of its functionality; no concrete malicious behavior was established.
Mechanism
Requests use configured endpoints and caller-supplied keys, while condition evaluation and script loading support configured form behavior.
AI rationale
Inspected entrypoints show package-aligned form behavior, with caller-configured authentication and integrations. Static inspection found no concrete malicious installation, credential theft, or agent control mutation.
Network endpoints2
api.trustedform.comapi.xapp.ai
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares React distribution entrypoints and a build-only prepare hook, with no registry install hooks or runtime self-dependency.
- API requests use the endpoint and authentication key supplied through widget configuration.
- TrustedForm script loading enforces the https://api.trustedform.com origin.
- Dynamic functions evaluate configured form conditions; external widget loading activates through configured form steps.
- Form submission reads named advertising attribution cookies rather than service authentication cookies.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
189contains invisible/control Unicode U+2066 (left-to-right isolate)
function(e){var t=Ib.default,n=Db.default;Object.defineProperty(e,"__esModule",{value:!0});var r={chainPropTypes:!0,deepmerge:!0,isPlainObject:!0,elementAcceptingRef:!0,elementTypeAcceptingRef:!0,exactProp:!0,formatMuiErrorMessage:!0,getDis
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.jsView on unpkg · L189•Trigger-reachable chain: manifest.main -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg319}
L320: `:null,zJ=(0,EJ.styled)("span",{name:"MuiSkeleton",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:n}=e;return[t.root,t[n.variant],!1!==n.animation&&t[n.animation],n.hasChil...
L321: /*! Copyright (c) 2025, XAPP AI */function M1(e,t){var n=e.slice(0,5);return!!t.find(function(e){if(e===n)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
3 Critical1 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
CriticalTrojan Source Unicodedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/form-widget@1.104.0.
See all versions of @xapp/form-widget for other recorded verdicts.
- Review the evidence and your use of @xapp/form-widget@1.104.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.