gatsby-core-theme@44.35.12
Gatsby Theme NPM Package
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe active server-side path forwards existing cookie data to an unrestricted environment-configured endpoint. This is a dangerous credential-forwarding capability, but the inspected source does not establish a hidden package-controlled recipient or malicious install behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Rendering a tracker page on the server, or submitting the newsletter form.
Impact
Cookies may be exposed to an unrestricted operator-configured tracking destination. No confirmed install-time attack surface was established.
Mechanism
The tracker serializes cookies into URL parameters and fetches an endpoint from GATSBY_TRACKING_API_URL; the newsletter performs a GET request containing form data and IP address.
AI rationale
The active server-side path forwards existing cookie data to an unrestricted environment-configured endpoint. This is a dangerous credential-forwarding capability, but the inspected source does not establish a hidden package-controlled recipient or malicious install behavior.
Evidence
src/components/app-tracker-ssr.jssrc/helpers/tracker.mjssrc/components/molecules/newsletter/form/index.js
Network endpoints1
bacom.dk/subscribe/gig/
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The server-side tracker passes request headers into the affiliate-link routine.
- The tracker serializes parsed request cookies into tracking parameters.
- Those parameters are sent to an endpoint selected by an environment variable.
- The newsletter form sends submitted contact data and IP address to bacom.dk.
- Package metadata contains no automatic install lifecycle script.
Evidence against
- The inspected metadata exposes only test and Storybook scripts, not preinstall, install, or postinstall hooks.
- No child-process or dynamic-code primitive was found in the targeted source inspection.
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged__mocks__/gatsby.jsView file
1const React = require('react');
L2:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
__mocks__/gatsby.jsView on unpkg · L1src/components/molecules/newsletter/form/index.jsView file
29const getData = async () => {
L30: await fetch("https://api.ipify.org/?format=json", {
L31: method: "GET",
L32: })
L33: .then((response) => response.json())
L34: .then((data) => {
...
L56: const timestamp = (Date.now() / 1000) | 0;
L57: const refUrl = removeTrailingSlash(process.env.GATSBY_SITE_URL);
L58: const validatePhoneNr = typeof phomeNumber === "undefined";
...
L74: res.text().then((text) => {
L75: text === "OK" ? (window.location.href = redirectUrl) : setError(true);
L76: })
Critical
Browser Phishing Redirect
Source redirects browser users to an external URL carrying identity material.
src/components/molecules/newsletter/form/index.jsView on unpkg · L29Findings
1 Critical1 High6 Medium4 Low
CriticalBrowser Phishing Redirectsrc/components/molecules/newsletter/form/index.js
HighSemantic Analysis Limitedsrc/components/app-tracker-ssr.js
MediumDynamic Require__mocks__/gatsby.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencesrc/components/app-tracker-ssr.js
MediumAi Review Evidencesrc/helpers/tracker.mjs
MediumAi Review Evidencesrc/helpers/tracker.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gatsby-core-theme@44.35.12.
See all versions of gatsby-core-theme for other recorded verdicts.
- Review the evidence and your use of gatsby-core-theme@44.35.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.