registry / lucien-form-builder / 2.8.43
lucien-form-builder@2.8.43
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package silently runs browser fingerprint tests on import, an unexplained privacy-sensitive behavior for a form builder. I found no evidence that the collected values are transmitted, so this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
Import of the package entry point in a browser.
Impact
Browser and device characteristics are gathered without an explicit request; no transmission of the results was identified.
Mechanism
The entry imports src/fingerprint.js, which runs browser tests and stores their results in a module-local object. A public-IP request helper is also defined but is not part of the automatic test list.
AI rationale
The package silently runs browser fingerprint tests on import, an unexplained privacy-sensitive behavior for a form builder. I found no evidence that the collected values are transmitted, so this warrants a warning rather than a malicious verdict.
Evidence
index.jssrc/fingerprint.js
Network endpoints1
api.ipify.org
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The main entry imports src/fingerprint.js as a side effect.
- That module automatically gathers browser characteristics, including installed fonts, local IP, canvas, platform and processor cores.
- A separate public-IP probe to api.ipify.org is defined in the fingerprint module, though it is absent from the automatic test list.
Evidence against
- The package declares an empty prepare script and no install or postinstall hook.
- The automatic fingerprint results are held in a module-local object; no transmission of those values was identified.
- The included WASM loader fetches blur_bg.wasm relative to its own module URL.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedrust_blur_lib/blur_bg.wasmView file
•path = rust_blur_lib/blur_bg.wasm
kind = wasm_module
sizeBytes = 16119
magicHex = [redacted]
Medium
package.jsonView file
•scripts changed=build
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgindex.jsView file
8import i18n from "./src/i18n";
import extendUnique from "./custom_rules/unique";
import extendPostalCode from "./custom_rules/postalcode";
import VeeValidate, { Validator } from "vee-validate";
import { version
Findings
1 Critical6 Medium5 Low
CriticalManifest Confusionpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulerust_blur_lib/blur_bg.wasm
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceindex.js
MediumAi Review Evidencesrc/fingerprint.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to lucien-form-builder@2.8.43.
See all versions of lucien-form-builder for other recorded verdicts.
- Review the evidence and your use of lucien-form-builder@2.8.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.