lucien-form-builder
This report shows the evidence for lucien-form-builder@2.8.41. 1 of 15 known versions is blocked or flagged. The newest version, 2.9.0, is flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package automatically queries an unrelated public-IP service to collect visitor-identifying data during browser initialization. The form payload also carries browser fingerprint data, but that does not account for the separate automatic request to api.ipify.org.
Decision evidence
public snapshot- The main entry imports src/fingerprint.js, whose initialization runs automatically.
- The fingerprint code requests the visitor’s public IP from https://api.ipify.org.
- On form submission, the package includes browser fingerprint data with the form payload sent to the configured endpoint.
- The manifest has no install, preinstall or postinstall hook; its prepare script is empty.
- Fingerprint data is also used as part of the form submission feature.
Source & flagged code
4 flaggedTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to lucien-form-builder@2.8.41.
The versions list below shows the verdict for each recorded version.
- Avoid installing lucien-form-builder@2.8.41. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.