registry / @xapp/form-widget / 1.110.7
@xapp/form-widget@1.110.7
Form Widget
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no registry install hook and its reviewed entrypoints show ordinary browser API-client behavior. Static inspection found no concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer invokes the address place-autocomplete functionality after importing the widget.
Impact
No confirmed malicious impact was established.
Mechanism
The client sends entered place-query data to its configured XAPP API base URL; no lifecycle-triggered execution, credential harvesting, or host mutation was found.
AI rationale
The package has no registry install hook and its reviewed entrypoints show ordinary browser API-client behavior. Static inspection found no concrete malicious behavior.
Network endpoints1
api.xapp.ai
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata defines only a prepare build hook and names the two reviewed distribution entrypoints.
- The CommonJS entry implements a browser place-autocomplete request to the package-aligned XAPP API using caller-provided input and API key.
- The ES module contains the same place-autocomplete client behavior; no install-time or import-time attack behavior was identified.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
189contains invisible/control Unicode U+2066 (left-to-right isolate)
function(e){var t=qb.default,n=Wb.default;Object.defineProperty(e,"__esModule",{value:!0});var r={chainPropTypes:!0,deepmerge:!0,isPlainObject:!0,elementAcceptingRef:!0,elementTypeAcceptingRef:!0,exactProp:!0,formatMuiErrorMessage:!0,getDis
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.jsView on unpkg · L189•Trigger-reachable chain: manifest.main -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg319}
L320: `:null,QJ=(0,BJ.styled)("span",{name:"MuiSkeleton",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:n}=e;return[t.root,t[n.variant],!1!==n.animation&&t[n.animation],n.hasChil...
L321: /*! Copyright (c) 2025, XAPP AI */function G1(e,t){var n=e.slice(0,5);return!!t.find(function(e){if(e===n)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
3 Critical1 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
CriticalTrojan Source Unicodedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/form-widget@1.110.7.
See all versions of @xapp/form-widget for other recorded verdicts.
- Review the evidence and your use of @xapp/form-widget@1.110.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.