registry / gatsby-core-theme / 44.35.11
gatsby-core-theme@44.35.11
Gatsby Theme NPM Package
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source does not establish malware or an install-hook attack, but it contains meaningful runtime data-sharing and remote-script behavior. Incomplete static coverage prevents a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A site visitor submits the newsletter form or interacts with a rendered Gatsby site.
Impact
Visitor contact details and IP address can be disclosed to a third-party newsletter endpoint; remote analytics JavaScript runs in the visitor’s browser.
Mechanism
Form-data transmission and dynamic third-party script injection.
AI rationale
The source does not establish malware or an install-hook attack, but it contains meaningful runtime data-sharing and remote-script behavior. Incomplete static coverage prevents a clean verdict.
Evidence
src/components/molecules/newsletter/form/index.jsgatsby-browser.jssrc/components/app-tracker-ssr.js
Network endpoints2
bacom.dk/subscribe/gig/pg.${process.env.GATSBY_SITE_NAME}/analytics.js
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The newsletter component sends a visitor’s name, email, optional phone number, IP address, referral details, and country to bacom.dk after form submission.
- The browser entry dynamically injects third-party analytics scripts, including a site-name-derived analytics host.
- Server-side page handling forwards request headers and URL to affiliate-link logic; the downstream handling was not fully resolved by static inspection.
Evidence against
- package.json has no preinstall, install, postinstall, or executable bin hook.
- No child-process execution, shell commands, eval, VM use, credential-file reads, or project-file mutation was found in the inspected source.
- The newsletter transmission is tied to a submitted newsletter form, rather than package installation or import.
Behavioral surface
EnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/components/molecules/newsletter/form/index.jsView file
29const getData = async () => {
L30: await fetch("https://api.ipify.org/?format=json", {
L31: method: "GET",
L32: })
L33: .then((response) => response.json())
L34: .then((data) => {
...
L56: const timestamp = (Date.now() / 1000) | 0;
L57: const refUrl = removeTrailingSlash(process.env.GATSBY_SITE_URL);
L58: const validatePhoneNr = typeof phomeNumber === "undefined";
...
L74: res.text().then((text) => {
L75: text === "OK" ? (window.location.href = redirectUrl) : setError(true);
L76: })
Critical
Browser Phishing Redirect
Source redirects browser users to an external URL carrying identity material.
src/components/molecules/newsletter/form/index.jsView on unpkg · L2962await fetch(
`https://bacom.dk/subscribe/gig/?firstname=${name}&user_ip=${ip}&ref_name=${refName}&ref_url=${refUrl}×tamp=${timestamp}&country=${country}&email=${email}${
!validatePhoneNr ? `&phone_number=${phomeNumber}` : ""
}`,
{
method: "GET",
Medium
Ai Review Evidence
The newsletter component sends a visitor’s name, email, optional phone number, IP address, referral details, and country to bacom.dk after form submission.
src/components/molecules/newsletter/form/index.jsView on unpkg · L62Findings
1 Critical1 High5 Medium4 Low
CriticalBrowser Phishing Redirectsrc/components/molecules/newsletter/form/index.js
HighSemantic Analysis Limitedsrc/components/app-tracker-ssr.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencesrc/components/molecules/newsletter/form/index.js
MediumAi Review Evidencegatsby-browser.js
MediumAi Review Evidencesrc/components/app-tracker-ssr.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gatsby-core-theme@44.35.11.
See all versions of gatsby-core-theme for other recorded verdicts.
- Review the evidence and your use of gatsby-core-theme@44.35.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.