hexo-theme-hipaper-keyboarddaily@1.7.3
Bugfix for A newspaper theme for Hexo.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe source confirms automatic visitor tracking to CNZZ under a theme-supplied identifier, separate from configuration-driven analytics options. This warrants a warning for conditional visitor data exposure, but does not establish credential theft or another block-level attack.
Static reason
No blocking static signals were detected.
Trigger
A site using the theme renders a page.
Impact
Visitor page-load traffic and associated analytics metadata are exposed to the CNZZ tracking account; no credential transfer was identified.
Mechanism
The footer loads a hidden CNZZ script with a fixed identifier and includes a second CNZZ analytics template using the same default identifier.
AI rationale
The source confirms automatic visitor tracking to CNZZ under a theme-supplied identifier, separate from configuration-driven analytics options. This warrants a warning for conditional visitor data exposure, but does not establish credential theft or another block-level attack.
Evidence
layout/layout.ejslayout/_partial/after-footer.ejs_config.ymllayout/_partial/cnzz-analytics.ejs
Network endpoints2
s11.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016s95.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The page layout includes the footer template on rendered pages.
- The footer contains a hidden script request to a fixed CNZZ tracking identifier.
- The theme configuration defaults to that same CNZZ identifier.
- The footer also includes a separate CNZZ analytics template.
- That template sends its configured identifier to a CNZZ endpoint, and the default enables it.
Evidence against
- The package is a static Hexo theme with no lifecycle hooks in its manifest.
- Other analytics integrations are configuration-driven; the identified risk is browser-side visitor tracking, with no inspected evidence of credential collection.
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggedlayout/layout.ejsView file
26<%- partial('_partial/after-footer') %>
</div>
<a id="rocket" href="#top" class=""></a>
<script type="text/javascript" src="/js/totop.js" async=""></script>
</body>
Medium
Ai Review Evidence
The page layout includes the footer template on rendered pages.
layout/layout.ejsView on unpkg · L26layout/_partial/after-footer.ejsView file
17<script src="https://s11.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016" language="JavaScript"></script>
</div>
<%- partial('post/mathjax.ejs') %>
<% if (theme.fancyb
Medium
Ai Review Evidence
The footer contains a hidden script request to a fixed CNZZ tracking identifier.
layout/_partial/after-footer.ejsView on unpkg · L1735<%- partial('cnzz-analytics') %>
<%- partial('busuanzi-analytics') %>
<%- partial('baidu-analytics') %>
<%- partial('tencent-analytics') %>
Findings
6 Medium3 Low
MediumNetwork
MediumAi Review Evidencelayout/layout.ejs
MediumAi Review Evidencelayout/_partial/after-footer.ejs
MediumAi Review Evidence_config.yml
MediumAi Review Evidencelayout/_partial/after-footer.ejs
MediumAi Review Evidencelayout/_partial/cnzz-analytics.ejs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hexo-theme-hipaper-keyboarddaily@1.7.3.
See all versions of hexo-theme-hipaper-keyboarddaily for other recorded verdicts.
- Review the evidence and your use of hexo-theme-hipaper-keyboarddaily@1.7.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.