lucien-form-builder@2.8.40
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package automatically collects browser fingerprint attributes and includes them with form submissions, without clear disclosure in the reviewed code. This may support fraud prevention, but the extra identifying data collection presents a user privacy risk.
Static reason
No blocking static signals were detected.
Trigger
Importing the package in a browser starts fingerprint collection; submitting a form sends the collected values.
Impact
This can transmit identifying browser characteristics beyond the fields entered by the user, creating an undisclosed tracking or profiling risk.
Mechanism
The code gathers browser and device characteristics, then adds the resulting fingerprint, page URL, user agent, and window dimensions to the form submission.
AI rationale
The package automatically collects browser fingerprint attributes and includes them with form submissions, without clear disclosure in the reviewed code. This may support fraud prevention, but the extra identifying data collection presents a user privacy risk.
Evidence
index.jssrc/fingerprint.jssrc/Form.vue
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package imports fingerprint code through its main entry point, which starts collecting browser attributes automatically.
- The fingerprint routine gathers browser characteristics such as canvas, installed fonts, language, storage availability, screen resolution, and platform.
- On form submission, the package sends the fingerprint alongside form data, the page URL, user agent, and window resolution.
Evidence against
- The package has no active install hook; its prepare script is empty.
- The fingerprint data is sent with an explicit form submission to a configurable endpoint, consistent with a possible form anti-abuse function.
- The public-IP lookup is registered in fingerprint.js but is not included in the browserTests list that runs automatically.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedrust_blur_lib/blur_bg.wasmView file
•path = rust_blur_lib/blur_bg.wasm
kind = wasm_module
sizeBytes = 16119
magicHex = [redacted]
Medium
package.jsonView file
•scripts changed=build
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgindex.jsView file
8import i18n from "./src/i18n";
import extendUnique from "./custom_rules/unique";
import extendPostalCode from "./custom_rules/postalcode";
import VeeValidate, { Validator } from "vee-validate";
import { version
Findings
1 Critical6 Medium5 Low
CriticalManifest Confusionpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulerust_blur_lib/blur_bg.wasm
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceindex.js
MediumAi Review Evidencesrc/fingerprint.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to lucien-form-builder@2.8.40.
See all versions of lucien-form-builder for other recorded verdicts.
- Review the evidence and your use of lucien-form-builder@2.8.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.