fiftyone.ipintelligence@4.5.99
IP intelligence services for the 51Degrees Pipeline API
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe builder enables a usage-sharing component by default without describing it in the package documentation. Because the component implementation was unavailable, this is a runtime telemetry concern rather than confirmed data exfiltration.
Static reason
No blocking static signals were detected.
Trigger
A consumer constructs the pipeline builder and uses the resulting pipeline.
Impact
Usage reporting may occur without clear disclosure; its data and destination could not be established.
Mechanism
The builder adds a ShareUsageElement by default; the element's implementation was unavailable for inspection.
AI rationale
The builder enables a usage-sharing component by default without describing it in the package documentation. Because the component implementation was unavailable, this is a runtime telemetry concern rather than confirmed data exfiltration.
Evidence
ipIntelligencePipelineBuilder.js
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The builder defaults shareUsage to true.
- When enabled, the builder inserts a ShareUsageElement into the pipeline.
Evidence against
- The package entry point only exports the pipeline builder; it does not construct a pipeline on import.
- The ShareUsageElement implementation was not present in the inspected source, so its destination and data fields could not be confirmed.
Behavioral surface
CopyleftLicense
Source & flagged code
2 flaggedipIntelligencePipelineBuilder.jsView file
88ation = 10,
shareUsage = true,
resourceKey = null,
cacheSize = null,
restrictedProperties,
performanceProfile = 'Balanced',
updat
Medium
Ai Review Evidence
The builder defaults shareUsage to true.
ipIntelligencePipelineBuilder.jsView on unpkg · L88100if so
if (shareUsage) {
this.flowElements.push(new ShareUsageElement());
}
let cache;
if (cacheSize) {
cache = new Lru
Medium
Ai Review Evidence
When enabled, the builder inserts a ShareUsageElement into the pipeline.
ipIntelligencePipelineBuilder.jsView on unpkg · L100Findings
2 Medium2 Low
MediumAi Review EvidenceipIntelligencePipelineBuilder.js
MediumAi Review EvidenceipIntelligencePipelineBuilder.js
LowScripts Present
LowCopyleft License
Affected versions and remediation
This report applies to fiftyone.ipintelligence@4.5.99.
See all versions of fiftyone.ipintelligence for other recorded verdicts.
- Review the evidence and your use of fiftyone.ipintelligence@4.5.99 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.