registry / lucien-form-builder / 2.8.42
lucien-form-builder@2.8.42
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package entry point imports browser feature detection, but its automatic test list does not run the separate public-IP lookup and the collected fingerprint is not sent elsewhere in the reviewed source. The manifest's prepare script is empty, and form requests use the configured service URL as expected for this package.
Static reason
No blocking static signals were detected.
Trigger
Importing the package registers form validators and starts local browser tests; mounting a form performs requests using its configured server.
Impact
No malicious or suspicious impact was identified in the reviewed paths.
Mechanism
The fingerprint module collects browser characteristics into an in-memory object. The listed automatic tests do not include the separate public-IP test, and no transmission of the collected fingerprint was identified.
AI rationale
The package entry point imports browser feature detection, but its automatic test list does not run the separate public-IP lookup and the collected fingerprint is not sent elsewhere in the reviewed source. The manifest's prepare script is empty, and form requests use the configured service URL as expected for this package.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest sets an empty prepare script and exposes index.js as the package entry point.
- The entry point imports the fingerprint module, whose automatic test list gathers browser characteristics but does not include its registered public-IP test.
- Form network requests use the configured server URL as part of form mounting.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedrust_blur_lib/blur_bg.wasmView file
•path = rust_blur_lib/blur_bg.wasm
kind = wasm_module
sizeBytes = 16119
magicHex = [redacted]
Medium
package.jsonView file
•scripts changed=build
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg2"name": "lucien-form-builder",
"version": "2.8.42",
"main": "index.js",
"engines": {
"node": "24.x"
},
"scripts": {
"build": "./node_modules/.bin/vue-cli-service build ./index.js",
Low
Ai Review Evidence
The manifest sets an empty prepare script and exposes index.js as the package entry point.
package.jsonFindings
1 Critical4 Medium7 Low
CriticalManifest Confusionpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulerust_blur_lib/blur_bg.wasm
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidenceindex.js
Affected versions and remediation
This report applies to lucien-form-builder@2.8.42.
See all versions of lucien-form-builder for other recorded verdicts.
- Review the evidence and your use of lucien-form-builder@2.8.42 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.