hazo_blog
SEO-optimized blogging package: posts, categories, tags, MDX content, and GA4/GSC/Bing-ready SEO.
This report shows the evidence for hazo_blog@2.0.0. 0 of 7 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically sends free-form search terms to host-configured analytics after successful searches, without an explicit opt-in or documented disable control. This is a runtime telemetry privacy risk, not evidence of credential theft or malicious install behavior.
Decision evidence
public snapshot- After a successful search, BlogSearch sends the typed query as the blog_search analytics event's query field.
- The analytics emitter forwards events to the host's existing GA4 integration through window.gtag or window.dataLayer.
- The manifest's scripts are build, type-check, test, and demo tasks; no install lifecycle hook is declared.
- Search requests use the component's configured endpoint, with a local path as the default.
- The package is a blogging library, and its search component only tracks after a user enters a query and results return.
Source & flagged code
4 flaggedAfter a successful search, BlogSearch sends the typed query as the blog_search analytics event's query field.
dist/components/blog-search.jsView on unpkg · L35After a successful search, BlogSearch sends the typed query as the blog_search analytics event's query field.
dist/components/blog-search.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to hazo_blog@2.0.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of hazo_blog@2.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.