gatsby-core-theme@44.35.10
Gatsby Theme NPM Package
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source supports privacy-sensitive collection and external transmission during normal site use, but not malicious install-time execution or covert compromise. The hard-coded newsletter endpoint and broad tracking payload warrant a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A visitor loads and submits the newsletter form, or requests an affiliate tracker page.
Impact
Personal and marketing-identification data can be disclosed to external services configured or hard-coded by the theme.
Mechanism
Client newsletter collection and server-side affiliate tracking.
AI rationale
The source supports privacy-sensitive collection and external transmission during normal site use, but not malicious install-time execution or covert compromise. The hard-coded newsletter endpoint and broad tracking payload warrant a warning.
Evidence
src/components/molecules/newsletter/form/index.jssrc/helpers/tracker.mjssrc/components/app-tracker-ssr.js
Network endpoints2
api.ipify.org/?format=jsonbacom.dk/subscribe/gig/
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines no preinstall, install, or postinstall hook.
- The newsletter component fetches a visitor IP address and sends it with submitted name, email, optional phone number, and referral data to bacom.dk.
- Server-side tracking serializes request-derived cookies, IP, user agent, referral, and marketing identifiers into a request to a deployment-configured tracking endpoint.
- The Gatsby server-data entry point invokes the affiliate-tracking helper for tracker pages.
Evidence against
- The manifest exposes only test and Storybook scripts; no package-install execution is defined.
- The observed network behavior is tied to newsletter and affiliate-tracking features in this Gatsby theme, not hidden install-time code.
- No child-process execution, remote code loading, credential-file harvesting, or persistence mechanism was found in the inspected source.
Behavioral surface
EnvironmentVarsFilesystemNativeBindingsNetwork
Source & flagged code
6 flaggedsrc/components/molecules/newsletter/form/index.jsView file
29const getData = async () => {
L30: await fetch("https://api.ipify.org/?format=json", {
L31: method: "GET",
L32: })
L33: .then((response) => response.json())
L34: .then((data) => {
...
L56: const timestamp = (Date.now() / 1000) | 0;
L57: const refUrl = removeTrailingSlash(process.env.GATSBY_SITE_URL);
L58: const validatePhoneNr = typeof phomeNumber === "undefined";
...
L74: res.text().then((text) => {
L75: text === "OK" ? (window.location.href = redirectUrl) : setError(true);
L76: })
Critical
Browser Phishing Redirect
Source redirects browser users to an external URL carrying identity material.
src/components/molecules/newsletter/form/index.jsView on unpkg · L2929const getData = async () => {
await fetch("https://api.ipify.org/?format=json", {
method: "GET",
})
.then((response) => response.json())
.then((data) => {
setIP(data.ip);
Medium
Ai Review Evidence
The newsletter component fetches a visitor IP address and sends it with submitted name, email, optional phone number, and referral data to bacom.dk.
src/components/molecules/newsletter/form/index.jsView on unpkg · L29Findings
1 Critical1 High6 Medium4 Low
CriticalBrowser Phishing Redirectsrc/components/molecules/newsletter/form/index.js
HighSemantic Analysis Limitedsrc/components/app-tracker-ssr.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencesrc/components/molecules/newsletter/form/index.js
MediumAi Review Evidencesrc/components/molecules/newsletter/form/index.js
MediumAi Review Evidencesrc/helpers/tracker.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gatsby-core-theme@44.35.10.
See all versions of gatsby-core-theme for other recorded verdicts.
- Review the evidence and your use of gatsby-core-theme@44.35.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.