registry / gatsby-core-theme / 44.35.3
gatsby-core-theme@44.35.3
Gatsby Theme NPM Package
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection shows a Gatsby gambling/affiliate theme with explicit, user-triggered newsletter and analytics behavior. No lifecycle execution, stealth persistence, payload execution, credential harvesting, or foreign control-surface mutation was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A site visitor submits the newsletter form; Gatsby build/runtime loads configured site features.
Impact
Visitor-provided newsletter data is sent to the configured subscription service; no install-time or covert host compromise is present.
Mechanism
Newsletter subscription, site-data retrieval, and optional analytics loading
AI rationale
Direct inspection shows a Gatsby gambling/affiliate theme with explicit, user-triggered newsletter and analytics behavior. No lifecycle execution, stealth persistence, payload execution, credential harvesting, or foreign control-surface mutation was found.
Evidence
package.jsonsrc/components/molecules/newsletter/form/index.jsgatsby-browser.jsgatsby-node.mjssrc/services/api.mjssrc/helpers/tracker.mjsindex.jssrc/services/fetch.mjs
Network endpoints6
api.ipify.org/?format=jsonbacom.dk/subscribe/gig/www.googletagmanager.com/gtm.jsa.omappapi.com/app/js/api.min.jsconnect.facebook.net/en_US/fbevents.js//bat.bing.com/bat.js
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Newsletter submission sends entered contact data and IP to bacom.dk.
- Browser entrypoint conditionally loads configured analytics scripts.
Evidence against
- package.json has no preinstall/install/postinstall hooks.
- Newsletter request occurs only after a rendered form is submitted.
- Redirect uses the component's redirectUrl prop only after a successful subscription.
- No child-process, eval/vm, native loading, or agent-control writes found.
- Build-time API calls use configured Gatsby API endpoints and credentials.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
1 flaggedsrc/components/molecules/newsletter/form/index.jsView file
29const getData = async () => {
L30: await fetch("https://api.ipify.org/?format=json", {
L31: method: "GET",
L32: })
L33: .then((response) => response.json())
L34: .then((data) => {
...
L56: const timestamp = (Date.now() / 1000) | 0;
L57: const refUrl = removeTrailingSlash(process.env.GATSBY_SITE_URL);
L58: const validatePhoneNr = typeof phomeNumber === "undefined";
...
L74: res.text().then((text) => {
L75: text === "OK" ? (window.location.href = redirectUrl) : setError(true);
L76: })
Critical
Browser Phishing Redirect
Source redirects browser users to an external URL carrying identity material.
src/components/molecules/newsletter/form/index.jsView on unpkg · L29Findings
1 Critical2 Medium4 Low
CriticalBrowser Phishing Redirectsrc/components/molecules/newsletter/form/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gatsby-core-theme@44.35.3.
See all versions of gatsby-core-theme for other recorded verdicts.
- Review the evidence and your use of gatsby-core-theme@44.35.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.