lucien-form-builder@2.8.39
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package automatically gathers detailed browser and device characteristics and includes them in form submissions without a visible disclosure or opt-out in the reviewed source. The transmission is part of the form service's normal submission flow, so this is an undisclosed collection concern rather than evidence of credential theft or an unrelated collector.
Static reason
No blocking static signals were detected.
Trigger
The package is imported, then a user submits a form.
Impact
The receiving service gets a detailed browser fingerprint beyond the submitted form fields; the source does not disclose this collection or provide a control to disable it.
Mechanism
The module gathers browser and device characteristics and adds them to the form submission sent to the configured server.
AI rationale
The package automatically gathers detailed browser and device characteristics and includes them in form submissions without a visible disclosure or opt-out in the reviewed source. The transmission is part of the form service's normal submission flow, so this is an undisclosed collection concern rather than evidence of credential theft or an unrelated collector.
Evidence
index.jssrc/fingerprint.jssrc/Form.vue
Network endpoints2
this.server + "/api/v2/submissions/" + this.form_idapi.ipify.org (registered lookup; not in the automatic test list)
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package imports fingerprinting code when its main entry point loads.
- Fingerprint data is collected automatically from browser and device characteristics, including canvas, fonts, language, screen, storage, and WebGL properties.
- On form submission, the package sends the fingerprint together with form data, page URL, user agent, and window dimensions to the submission endpoint.
Evidence against
- The submission endpoint is constructed from the form's configured server and form ID.
- Fingerprint data is sent as part of the form submission, not in a separate background request.
- The registered public-IP lookup is not included in the automatic browser test list.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedrust_blur_lib/blur_bg.wasmView file
•path = rust_blur_lib/blur_bg.wasm
kind = wasm_module
sizeBytes = 16119
magicHex = [redacted]
Medium
package.jsonView file
•scripts changed=build
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgindex.jsView file
13import "./src/fingerprint";
import Dayjs from "vue-dayjs";
console.log("PROMO.DEV FORM BUILDER", version);
import fr f
Findings
1 Critical6 Medium5 Low
CriticalManifest Confusionpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulerust_blur_lib/blur_bg.wasm
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceindex.js
MediumAi Review Evidencesrc/fingerprint.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to lucien-form-builder@2.8.39.
See all versions of lucien-form-builder for other recorded verdicts.
- Review the evidence and your use of lucien-form-builder@2.8.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.