lucien-form-builder@2.8.44
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package gathers a broad browser fingerprint automatically and sends it with form submissions, without visible disclosure or an opt-out in the reviewed source. The destination is configured by the consumer and the transmission happens on form submission, so this is suspicious telemetry rather than evidence of credential theft or unrelated exfiltration.
Static reason
No blocking static signals were detected.
Trigger
Package import starts fingerprint collection; the collected values are transmitted when the user submits a form.
Impact
The form service receives a detailed browser fingerprint that can help identify or track a user across submissions.
Mechanism
The package gathers browser and device attributes, then includes them in a PUT request to the server configured for the form.
AI rationale
The package gathers a broad browser fingerprint automatically and sends it with form submissions, without visible disclosure or an opt-out in the reviewed source. The destination is configured by the consumer and the transmission happens on form submission, so this is suspicious telemetry rather than evidence of credential theft or unrelated exfiltration.
Evidence
index.jssrc/fingerprint.jssrc/Form.vue
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Importing the package imports src/fingerprint, whose top-level initialization gathers browser fingerprint data.
- The fingerprint includes browser attributes such as installed fonts, language, plugins, screen resolution and hardware concurrency.
- On form submission, the package sends the collected fingerprint with form data to the configured server endpoint.
Evidence against
- The prepare lifecycle script is empty.
- The form endpoint is built from the required server prop, and submission occurs in the form submission handler.
- The changed MultiSelect code sends search requests only when AJAX options and a URL are configured.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedrust_blur_lib/blur_bg.wasmView file
•path = rust_blur_lib/blur_bg.wasm
kind = wasm_module
sizeBytes = 16119
magicHex = [redacted]
Medium
package.jsonView file
•scripts changed=build
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgindex.jsView file
11import VeeValidate, { Validator } from "vee-validate";
import { version } from "./package.json";
import "./src/fingerprint";
import Dayjs from "vue-dayjs";
console.log("
Findings
1 Critical6 Medium5 Low
CriticalManifest Confusionpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulerust_blur_lib/blur_bg.wasm
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceindex.js
MediumAi Review Evidencesrc/fingerprint.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to lucien-form-builder@2.8.44.
See all versions of lucien-form-builder for other recorded verdicts.
- Review the evidence and your use of lucien-form-builder@2.8.44 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.