ct-answer-designer@1.1.9
Vue3工单组件库，包含PC端和移动端工单组件
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package includes undisclosed runtime telemetry that sends the page hostname and FormCreate license value to api.form-create.com. Because the telemetry carries identifying details, this is suspicious rather than ordinary anonymous usage reporting.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the bundled reporting code's runtime condition passes, with a 10% random sampling gate.
Impact
The vendor receives identifying host information and the license value without clear disclosure in the package documentation.
Mechanism
It encodes the hostname and license value into an Image request to api.form-create.com.
AI rationale
The package includes undisclosed runtime telemetry that sends the page hostname and FormCreate license value to api.form-create.com. Because the telemetry carries identifying details, this is suspicious rather than ordinary anonymous usage reporting.
Evidence
dist/ct-answer-designer.umd.jsdist/ct-answer-designer.es.js
Network endpoints1
api.form-create.com/h.png?u=
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The UMD entry point sends the page hostname and FormCreate license value to an endpoint on api.form-create.com.
- The request is encoded and sent through an Image URL when a runtime condition passes and a 10% random sample is selected.
- The telemetry code also appears in the ES module bundle.
Evidence against
- The package describes itself as a Vue work-order component library, and the reporting code is within bundled FormCreate-related code.
- The only lifecycle script is prepublishOnly, which runs a build rather than contacting a host during registry installation.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flaggeddist/ct-answer-designer.umd.jsView file
•Browser cookie sent to a fixed external endpoint in dist/ct-answer-designer.umd.js:
(function(He,u){typeof exports=="object"&&typeof module<"u"?u(exports,require("vue"),require("element-plus"),require("axios"),require("vant")):typeof define=="function"&&define.amd...
}`,variables:v}}function S(v,y){var m=Object.keys(v);if(Object.getOwnPropertySymbols){var k=Object.getOwnPropertySymbols(v);y&&(k=k.filter(function(T){return Object.getOwnPropertyD...
* (c) 2018-2025 FormCreate Team https://form-create.com/
* Github https://github.com/xaboy/form-create
In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Un(t,e){return Object.keys(t).reduce(function(r,n){return(!e||e.indexOf(n)===-1)&&(r[n...
err: `).concat(a));return}}return t}function Nl(t,e){return
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/ct-answer-designer.umd.jsView on unpkg49L50: err: ${i}`);return}}return t}const zm=u.defineComponent({name:"DataTable",emits:["sortChange","handleClick","currentChange"],props:{column:{type:Array,default:()=>[]},globalDataKey...
L51: * Signature Pad v5.1.1 | https://github.com/szimek/signature_pad
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/ct-answer-designer.umd.jsView on unpkg · L49Findings
1 Critical2 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/ct-answer-designer.umd.js
HighBase64 Obscured Urldist/ct-answer-designer.umd.js
HighSemantic Analysis Limiteddist/ct-answer-designer-sdk.es.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/ct-answer-designer.umd.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ct-answer-designer@1.1.9.
See all versions of ct-answer-designer for other recorded verdicts.
- Review the evidence and your use of ct-answer-designer@1.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.