hexo-theme-hipaper-keyboarddaily@1.9.1
Bugfix for A newspaper theme for Hexo.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe unconditional hidden analytics tracker creates a real but unresolved visitor data disclosure risk. The inspected manifest and configurable analytics code provide no evidence of an install-time attack or consent for this fixed tracker.
Static reason
No blocking static signals were detected.
Trigger
Rendering a page with the theme.
Impact
Visitor activity may be recorded under the fixed tracking identifier; the package does not establish who controls that account or what data it receives.
Mechanism
The shared layout includes an after-footer partial that embeds the tracker unconditionally.
AI rationale
The unconditional hidden analytics tracker creates a real but unresolved visitor data disclosure risk. The inspected manifest and configurable analytics code provide no evidence of an install-time attack or consent for this fixed tracker.
Evidence
layout/layout.ejslayout/_partial/after-footer.ejs
Network endpoints1
s11.cnzz.com/z_stat.php
Decision evidence
public snapshotAI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The theme layout always includes an after-footer partial.
- That partial embeds a hidden analytics script with a fixed tracking identifier and no visible configuration guard.
- Other analytics integrations in the package are gated by theme settings, leaving the fixed tracker as an unresolved, automatic visitor data transfer.
Evidence against
- The manifest lists theme assets and development dependencies; no lifecycle hook is shown in the inspected manifest excerpt.
- The configurable analytics partial runs only when its setting is enabled.
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flaggedlayout/layout.ejsView file
24tial('_partial/mobile-nav', null, {cache: !config.relative_link}) %> -->
<%- partial('_partial/footer', null, {cache: !config.relative_link}) %>
<%- partial('_partial/after-footer') %>
</div>
<a id="roc
Medium
Ai Review Evidence
The theme layout always includes an after-footer partial.
layout/layout.ejsView on unpkg · L24layout/_partial/after-footer.ejsView file
16play: none;">
<script src="https://s11.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016" language="JavaScript"></script>
</div>
<%- partial('post/mathjax.ejs') %>
<% if (theme.fancybox){ %>
<%- css('fancy
Medium
Ai Review Evidence
That partial embeds a hidden analytics script with a fixed tracking identifier and no visible configuration guard.
layout/_partial/after-footer.ejsView on unpkg · L16layout/_partial/gauges-analytics.ejs
Findings
5 Medium3 Low
MediumNetwork
MediumAi Review Evidencelayout/layout.ejs
MediumAi Review Evidencelayout/_partial/after-footer.ejs
MediumAi Review Evidencelayout/_partial/gauges-analytics.ejs
MediumAi Review Evidencepackage.json
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hexo-theme-hipaper-keyboarddaily@1.9.1.
See all versions of hexo-theme-hipaper-keyboarddaily for other recorded verdicts.
- Review the evidence and your use of hexo-theme-hipaper-keyboarddaily@1.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.