registry / @xapp/form-widget / 1.110.1
@xapp/form-widget@1.110.1
Form Widget
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a compiled React form widget with normal browser-side form, analytics, and optional TrustedForm integration. Static findings are explained by bundled dependencies and configured widget behavior; no concrete malicious lifecycle or exfiltration chain was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A host page renders the widget and a user interacts with a form.
Impact
Form and attribution data are sent to the configured service endpoint as part of widget operation.
Mechanism
Configured browser form submission and event tracking.
AI rationale
The package is a compiled React form widget with normal browser-side form, analytics, and optional TrustedForm integration. Static findings are explained by bundled dependencies and configured widget behavior; no concrete malicious lifecycle or exfiltration chain was found.
Network endpoints2
api.trustedform.comapi.xapp.ai
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has only a prepare build script and no preinstall, install, or postinstall hook.
- The compiled browser entrypoints conditionally load TrustedForm only when its URL has the exact api.trustedform.com origin.
- Runtime network activity is form-widget functionality: it uses caller-provided API URLs and sends widget events.
Evidence against
- No self-dependency, executable bin, shell execution, filesystem harvesting, or install-time control-surface mutation was found.
- The reported environment-variable and dynamic-code indicators are bundled UI dependency code, not package-owned attack behavior.
- The external TrustedForm loader rejects unexpected origins.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
189contains invisible/control Unicode U+2066 (left-to-right isolate)
function(e){var t=qb.default,n=Wb.default;Object.defineProperty(e,"__esModule",{value:!0});var r={chainPropTypes:!0,deepmerge:!0,isPlainObject:!0,elementAcceptingRef:!0,elementTypeAcceptingRef:!0,exactProp:!0,formatMuiErrorMessage:!0,getDis
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.jsView on unpkg · L189•Trigger-reachable chain: manifest.main -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg319}
L320: `:null,ZJ=(0,BJ.styled)("span",{name:"MuiSkeleton",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:n}=e;return[t.root,t[n.variant],!1!==n.animation&&t[n.animation],n.hasChil...
L321: /*! Copyright (c) 2025, XAPP AI */function W1(e,t){var n=e.slice(0,5);return!!t.find(function(e){if(e===n)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
3 Critical1 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
CriticalTrojan Source Unicodedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/form-widget@1.110.1.
See all versions of @xapp/form-widget for other recorded verdicts.
- Review the evidence and your use of @xapp/form-widget@1.110.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.