@xapp/form-widget@1.118.0
Form Widget
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically sends partial form entries as an event when a user closes an incomplete form, and the README does not disclose that collection. The destination is the configured form API, which makes this an undocumented tracking concern rather than evidence of a malicious external receiver.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Widget close or page unload while a form is incomplete.
Impact
Form values may be transmitted for abandonment tracking without users being told that partial entries are collected.
Mechanism
The widget packages entered values and abandonment details into a partial-data event, then posts the event to /cms/widget/events at the configured API URL’s origin.
AI rationale
The package automatically sends partial form entries as an event when a user closes an incomplete form, and the README does not disclose that collection. The destination is the configured form API, which makes this an undocumented tracking concern rather than evidence of a malicious external receiver.
Evidence
dist/index.es.jsREADME.md
Network endpoints1
Configured API URL origin: /cms/widget/events
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- When the widget closes, it records entered form values as partial data with abandonmentReason "widget_close".
- The event beacon sends event data in a JSON POST.
- The beacon endpoint uses the configured API URL’s origin and the path /cms/widget/events.
- The package describes itself as a form widget, and its README documents attribution analytics but not automatic partial-form tracking.
Evidence against
- The destination is derived from the widget’s configured API URL, consistent with its form-service purpose.
- The README documents automatic analytics tracking of URL attribution parameters.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
1"use strict";var e=require("react/jsx-runtime"),n=require("react"),t=function(){return t=Object.assign||function(e){for(var n,t=1,r=arguments.length;t<r;t++)for(var a in n=argument...
L2: /*! Copyright (c) 2025, XAPP AI */function fo(e,n){var t=e.slice(0,5);return!!n.find(function(e){if(e===t)return!0;if(e.includes("*")){var n=e.replace(/\*/g,"\\d")+"$";return new R...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11"use strict";var e=require("react/jsx-runtime"),n=require("react"),t=function(){return t=Object.assign||function(e){for(var n,t=1,r=arguments.length;t<r;t++)for(var a in n=argument...
L2: /*! Copyright (c) 2025, XAPP AI */function fo(e,n){var t=e.slice(0,5);return!!n.find(function(e){if(e===t)return!0;if(e.includes("*")){var n=e.replace(/\*/g,"\\d")+"$";return new R...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L1dist/index.es.jsView file
Findings
1 Critical1 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.es.js
MediumAi Review Evidencedist/index.es.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/form-widget@1.118.0.
See all versions of @xapp/form-widget for other recorded verdicts.
- Review the evidence and your use of @xapp/form-widget@1.118.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.