registry / arcy.js
arcy.js
ARCY, the universal JavaScript utility for embedding an AI agent that talks to, learns from, and acts on behalf of your users.
This report shows the evidence for arcy.js@0.8.1. 0 of 29 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 14h ago · by lpm-firewall-aiThe flagged callback resolves to ARCY’s own telemetry endpoint, and the SDK only records consent after an explicit answer. The package’s lifecycle script is a release-time build step, with no install hook identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Application code initializes the SDK; telemetry is sent after visitor consent and when events are collected.
Impact
No malicious behavior identified. Telemetry is part of the documented service and is gated on visitor consent.
Mechanism
The SDK batches telemetry events and posts them to its own ARCY service using the configured environment token.
AI rationale
The flagged callback resolves to ARCY’s own telemetry endpoint, and the SDK only records consent after an explicit answer. The package’s lifecycle script is a release-time build step, with no install hook identified.
Network endpoints1
api.arcyai.com/api/v1/sdk/telemetry
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entrypoints expose the ARCY browser SDK; its only lifecycle script is prepublishOnly, which runs a release check and build.
- Telemetry consent is unset until an answer is stored, and the README instructs users to connect the visitor’s consent banner to the SDK.
- Telemetry posts go to the package’s own api.arcyai.com endpoint using the configured token.
- The SDK’s documented purpose is to embed an ARCY agent in a site, consistent with its browser networking and telemetry features.
Evidence against
- The package does collect and send runtime telemetry when consent is granted.
- The SDK sends telemetry batches with a bearer token to /api/v1/sdk/telemetry.
Behavioral surface
Network
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggeddist/stage.cjsView file
1986patternName = generic_password
severity = medium
line = 1986
Medium
8226patternName = generic_password
severity = medium
line = 8226
Medium
dist/index.cjsView file
•Trigger-reachable fixed external POST callback chain: manifest.main -> dist/index.cjs
/* arcy.js — https://arcyai.com */
method: "POST",
body: JSON.stringify(sessionId ? { sessionId } : {}),
method: "POST",
body: JSON.stringify(sessionId ? { sessionId } : {}),
async function postFlowAnswer(flowCvid, body, options) {
method: "POST",
body: JSON.stringify({
High
Trigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
Findings
2 High6 Medium5 Low
HighTrigger Reachable External Post Callbackdist/index.cjs
HighPrevious Version Dangerous Deltadist/chunk-C47VIKV6.js
MediumSecret Patterndist/stage.cjs
MediumNetwork
MediumSecret Patterndist/stage.cjs
MediumSecret Patterndist/control-resolver.cjs
MediumSecret Patterndist/chunk-5FQ3ZQMF.js
MediumSecret Patterndist/chunk-HE744WUG.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to arcy.js@0.8.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of arcy.js@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.