registry / gatsby-core-theme / 44.35.7
gatsby-core-theme@44.35.7
Gatsby Theme NPM Package
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection found no lifecycle execution, credential harvesting, shell execution, payload loading, or persistence. The scanner hit is a user-facing newsletter flow and consent-gated site analytics, not a concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A site renders the newsletter; a user submits its form.
Impact
Visitor contact data and IP can be sent to the subscription provider; no package-host compromise or persistence was found.
Mechanism
IP lookup and user-invoked newsletter subscription request.
AI rationale
Source inspection found no lifecycle execution, credential harvesting, shell execution, payload loading, or persistence. The scanner hit is a user-facing newsletter flow and consent-gated site analytics, not a concrete malicious chain.
Evidence
package.jsonsrc/components/molecules/newsletter/form/index.jsgatsby-browser.jsgatsby-node.mjs
Network endpoints2
api.ipify.org/?format=jsonbacom.dk/subscribe/gig/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Manifest has no npm lifecycle hooks; only test and Storybook scripts.
- Newsletter IP lookup runs in the rendered React component.
- Newsletter submission sends entered fields to its named subscription endpoint and redirects only after an OK response.
- Analytics loading is guarded by consent-category checks and environment flags.
- Build-time file writes generate site artifacts, not host persistence.
Evidence against
- Newsletter includes the visitor IP and entered contact fields in a third-party GET request.
- Browser entrypoint can load configured third-party analytics scripts.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedsrc/components/molecules/newsletter/form/index.jsView file
29const getData = async () => {
L30: await fetch("https://api.ipify.org/?format=json", {
L31: method: "GET",
L32: })
L33: .then((response) => response.json())
L34: .then((data) => {
...
L56: const timestamp = (Date.now() / 1000) | 0;
L57: const refUrl = removeTrailingSlash(process.env.GATSBY_SITE_URL);
L58: const validatePhoneNr = typeof phomeNumber === "undefined";
...
L74: res.text().then((text) => {
L75: text === "OK" ? (window.location.href = redirectUrl) : setError(true);
L76: })
Critical
Browser Phishing Redirect
Source redirects browser users to an external URL carrying identity material.
src/components/molecules/newsletter/form/index.jsView on unpkg · L2929const getData = async () => {
await fetch("https://api.ipify.org/?format=json", {
method: "GET",
})
.then((response) => response.json())
.then((data) => {
setIP(data.ip);
})
.catch((err) => {
// eslint-disable-next-line no-console
console.log(`Error ${err}`);
});
};
useEffect(() => {
getData();
}, []);
Low
Ai Review Evidence
Newsletter IP lookup runs in the rendered React component.
src/components/molecules/newsletter/form/index.jsView on unpkg · L29Findings
1 Critical2 Medium7 Low
CriticalBrowser Phishing Redirectsrc/components/molecules/newsletter/form/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/components/molecules/newsletter/form/index.js
LowAi Review Evidencegatsby-node.mjs
Affected versions and remediation
This report applies to gatsby-core-theme@44.35.7.
See all versions of gatsby-core-theme for other recorded verdicts.
- Review the evidence and your use of gatsby-core-theme@44.35.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.