registry / @xapp/form-widget / 1.95.1
@xapp/form-widget@1.95.1
Form Widget
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic hints conflate bundled React code and browser-widget functionality with malware. Direct inspection shows package-aligned, runtime browser behavior and no concrete malicious installation or execution chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Consumer renders and configures the widget; form actions, event tracking, address autocomplete, or optional TrustedForm integration invoke network behavior.
Impact
Configured form and attribution data may be sent to the widget backend as part of normal product operation; no stealth execution, persistence, or host compromise behavior was found.
Mechanism
Configured browser form submission, analytics, address autocomplete, and allowlisted third-party script integration.
AI rationale
Static hints conflate bundled React code and browser-widget functionality with malware. Direct inspection shows package-aligned, runtime browser behavior and no concrete malicious installation or execution chain.
Evidence
package.jsondist/index.es.jsdist/index.es.js.mapdist/xapp-form-widget.jsdist/index.js
Network endpoints2
api.xapp.aiapi.trustedform.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- `dist/index.es.js.map` contains two `new Function` uses for form-condition expressions.
- `dist/index.es.js.map` sends widget requests and analytics events to the configured API URL.
Evidence against
- `package.json` has no `preinstall`, `install`, or `postinstall` hook; `prepare` only invokes `npm run build`.
- No Node child-process, filesystem, VM, network-module imports, executable artifacts, or Unicode bidi controls were found in distributed files.
- `../src/utils/useTrustedForm.ts` permits dynamic script loading only from `https://api.trustedform.com`.
- `../src/components/FormDisplay/FormDisplay.tsx` and `FormStepDisplay.tsx` use `new Function` solely to evaluate configured form conditions.
- Browser storage and cookie reads support widget sessions, attribution, and form submission; no arbitrary credential harvesting is present.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStrings
Source & flagged code
4 flaggeddist/index.jsView file
189contains invisible/control Unicode U+2066 (left-to-right isolate)
function(e){var t=nb.default,r=Zg.default;Object.defineProperty(e,"__esModule",{value:!0});var n={chainPropTypes:!0,deepmerge:!0,isPlainObject:!0,elementAcceptingRef:!0,elementTypeAcceptingRef:!0,exactProp:!0,formatMuiErrorMessage:!0,getDis
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.jsView on unpkg · L189•Trigger-reachable chain: manifest.main -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg319}
L320: `:null,sZ=(0,JJ.styled)("span",{name:"MuiSkeleton",slot:"Root",overridesResolver:(e,t)=>{const{ownerState:r}=e;return[t.root,t[r.variant],!1!==r.animation&&t[r.animation],r.hasChil...
L321: /*! Copyright (c) 2025, XAPP AI */function y0(e,t){var r=e.slice(0,5);return!!t.find(function(e){if(e===r)return!0;if(e.includes("*")){var t=e.replace(/\*/g,"\\d")+"$";return new R...
Findings
2 Critical2 High3 Medium5 Low
CriticalTrojan Source Unicodedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Process
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xapp/form-widget@1.95.1.
See all versions of @xapp/form-widget for other recorded verdicts.
- Review the evidence and your use of @xapp/form-widget@1.95.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.