aiblogwrite@0.4.0
Add an AI-written, SEO-ready blog to your Next.js site with one command: /blog pages on your own domain, a sitemap, and a /blog-admin page to write and schedule posts.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package's automatic view pixel and CTA click reporting are consistent with its dashboard features, but this runtime telemetry is not disclosed in the README and has no opt-out setting. No credential theft, install-time behavior or unrelated data collection was identified.
Decision evidence
public snapshot- Each rendered post page automatically loads a tracking pixel from the post's viewUrl to count views.
- The browser sends a request to clickUrl when a reader clicks a post CTA; the package describes this as dashboard click counting.
- The package defaults its content API to admin.aiblogwrite.com and fetches posts for the configured site domain.
- The manifest has no install, preinstall or postinstall lifecycle script.
- The tracking records post views and CTA clicks, which fit the package's blog dashboard features.
- CTA tracking is limited to an explicit click and omits automated browsers.
- The observed network behavior does not read or transmit credentials or local project data.
Source & flagged code
4 flaggedPackage source references dynamic require/import behavior.
bin/lib/code.mjsView on unpkg · L14This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/aiblogwrite.mjsView on unpkgFindings
Affected versions and remediation
This report applies to aiblogwrite@0.4.0.
See all versions of aiblogwrite for other recorded verdicts.
- Review the evidence and your use of aiblogwrite@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.