@xapp/form-widget@1.119.0
Form Widget
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe widget automatically sends partial form answers on abandonment, which creates a privacy-sensitive runtime telemetry risk without an evident opt-in. The receiver comes from the embedding app’s configured server, and the inspected code does not show credential theft or an unrelated collector, so this merits a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When a user closes the widget or leaves the page with the form incomplete; a timeout path also reports partial data.
Impact
Incomplete form answers may be disclosed to the application’s configured backend without an explicit end-user opt-in.
Mechanism
The widget packages current form fields into a partial_data event and sends a keepalive beacon to `/cms/widget/events` at the configured API origin.
AI rationale
The widget automatically sends partial form answers on abandonment, which creates a privacy-sensitive runtime telemetry risk without an evident opt-in. The receiver comes from the embedding app’s configured server, and the inspected code does not show credential theft or an unrelated collector, so this merits a warning rather than a block.
Evidence
dist/index.es.js
Network endpoints1
Configured connection.serverUrl origin + /cms/widget/events
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- On widget close, the code includes `partialData` in a `partial_data` event.
- On tab close, the code sends current partial form data with a `close_tab` abandonment reason.
- The event beacon posts to `/cms/widget/events` on the origin of the configured API URL.
- The embedded widget obtains that API URL from `connection.serverUrl`.
- The `prepare` script runs the package build.
Evidence against
- The receiver is selected through the embedding app’s configuration; the inspected event path does not show a separate hard-coded collector.
- The package is a form widget, and the partial data is sent as form abandonment tracking.
- No credential harvesting, shell execution, or unrelated host transfer was identified in the inspected paths.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
1"use strict";var e=require("react/jsx-runtime"),n=require("react"),t=function(){return t=Object.assign||function(e){for(var n,t=1,r=arguments.length;t<r;t++)for(var a in n=argument...
L2: /*! Copyright (c) 2025, XAPP AI */function ko(e,n){var t=e.slice(0,5);return!!n.find(function(e){if(e===t)return!0;if(e.includes("*")){var n=e.replace(/\*/g,"\\d")+"$";return new R...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11"use strict";var e=require("react/jsx-runtime"),n=require("react"),t=function(){return t=Object.assign||function(e){for(var n,t=1,r=arguments.length;t<r;t++)for(var a in n=argument...
L2: /*! Copyright (c) 2025, XAPP AI */function ko(e,n){var t=e.slice(0,5);return!!n.find(function(e){if(e===t)return!0;if(e.includes("*")){var n=e.replace(/\*/g,"\\d")+"$";return new R...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L1dist/index.es.jsView file
Findings
1 Critical1 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.es.js
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/index.es.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/form-widget@1.119.0.
See all versions of @xapp/form-widget for other recorded verdicts.
- Review the evidence and your use of @xapp/form-widget@1.119.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.