hissakdx-wix-ssr-callback-canary@1.0.2
Environment-separated callback canary for an authorized Wix SSR security test
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe canary framing suggests a security-test purpose, but importing the package silently contacts an external callback collector without an opt-in. The requests omit credentials and contain no explicit body, so this is suspicious undisclosed runtime telemetry rather than demonstrated credential or content theft.
Decision evidence
public snapshot- Importing the exported entry point automatically calls a fixed webhook.site URL tagged with the detected execution context.
- The worker canary also calls the same webhook.site collector when its IIFE runs.
- The manifest describes the package as a Wix SSR security-test canary.
- The callback requests omit credentials and send no explicit request body.
- The package description presents the callbacks as part of an authorized security test.
Source & flagged code
3 flaggedThe manifest describes the package as a Wix SSR security-test canary.
package.jsonView on unpkg · L4Importing the exported entry point automatically calls a fixed webhook.site URL tagged with the detected execution context.
index.jsView on unpkg · L11Findings
Affected versions and remediation
This report applies to hissakdx-wix-ssr-callback-canary@1.0.2.
See all versions of hissakdx-wix-ssr-callback-canary for other recorded verdicts.
- Review the evidence and your use of hissakdx-wix-ssr-callback-canary@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.