hazo_blog@2.0.0
SEO-optimized blogging package: posts, categories, tags, MDX content, and GA4/GSC/Bing-ready SEO.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically sends free-form search terms to host-configured analytics after successful searches, without an explicit opt-in or documented disable control. This is a runtime telemetry privacy risk, not evidence of credential theft or malicious install behavior.
Static reason
No blocking static signals were detected.
Trigger
A mounted BlogSearch component receives a query of at least two characters and its search request succeeds.
Impact
Search terms may be disclosed to the host's analytics service without an explicit opt-in or documented control to disable this event.
Mechanism
The component emits a blog_search event containing the query through the host's existing GA4 gtag or dataLayer integration.
AI rationale
The package automatically sends free-form search terms to host-configured analytics after successful searches, without an explicit opt-in or documented disable control. This is a runtime telemetry privacy risk, not evidence of credential theft or malicious install behavior.
Evidence
dist/components/blog-search.jsdist/lib/analytics.js
Network endpoints2
Host-configured GA4 via window.gtag or window.dataLayerConfigured search endpoint; default `${basePath}/api/search`
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After a successful search, BlogSearch sends the typed query as the blog_search analytics event's query field.
- The analytics emitter forwards events to the host's existing GA4 integration through window.gtag or window.dataLayer.
- The manifest's scripts are build, type-check, test, and demo tasks; no install lifecycle hook is declared.
Evidence against
- Search requests use the component's configured endpoint, with a local path as the default.
- The package is a blogging library, and its search component only tracks after a user enters a query and results return.
Behavioral surface
CryptoNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/components/blog-search.jsView file
35setOpen(true);
trackBlogEvent("blog_search", { query: q, results: posts.length });
}
Medium
Ai Review Evidence
After a successful search, BlogSearch sends the typed query as the blog_search analytics event's query field.
dist/components/blog-search.jsView on unpkg · L3529const res = await fetch(`${url}?q=${encodeURIComponent(q)}`);
if (!res.ok)
return;
const data = (await res.json());
const posts = ("posts" in data && data.posts) || ("data" in data && data.data) || [];
setResults(posts);
Medium
Ai Review Evidence
After a successful search, BlogSearch sends the typed query as the blog_search analytics event's query field.
dist/components/blog-search.jsView on unpkg · L29dist/lib/analytics.jsView file
1// Client-safe analytics emitter. Sends blog events to the host's existing GA4
// via window.gtag, falling back to window.dataLayer. No GA script is bundled.
/** Emit a blog analytics event to whatever GA the host already wired. */
export function trackBlogEvent(name, params = {}) {
if (typeof window === "undefined")
return;
const w
Findings
5 Medium3 Low
MediumNetwork
MediumAi Review Evidencedist/components/blog-search.js
MediumAi Review Evidencedist/lib/analytics.js
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/components/blog-search.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hazo_blog@2.0.0.
See all versions of hazo_blog for other recorded verdicts.
- Review the evidence and your use of hazo_blog@2.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.