lucien-form-builder@2.9.0
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package automatically gathers browser and device traits, including a local IP address, and sends the fingerprint with form submissions without an evident disclosure or opt-in. This is suspicious telemetry; the ordinary form submission and selected-file upload flows otherwise fit the package's purpose.
Static reason
No blocking static signals were detected.
Trigger
The fingerprint collection starts when the package entry point is loaded; results are sent when a form is submitted.
Impact
The form service receives identifying browser data beyond the fields a user submits, which can enable tracking across submissions.
Mechanism
The module gathers browser and device traits, including a local IP address, and Form.vue adds the resulting fingerprint to the submission payload.
AI rationale
The package automatically gathers browser and device traits, including a local IP address, and sends the fingerprint with form submissions without an evident disclosure or opt-in. This is suspicious telemetry; the ordinary form submission and selected-file upload flows otherwise fit the package's purpose.
Evidence
index.jssrc/fingerprint.jssrc/Form.vue
Network endpoints2
api.lucien.ai<configured server>/api/v2/submissions/{form_id}
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package entry point imports the fingerprint module when loaded.
- The fingerprint module collects browser and device traits, including a local IP address obtained through WebRTC.
- Fingerprint results are attached to form data sent automatically when a user submits a form.
- The manifest's prepare script is empty.
Evidence against
- Form submissions are sent to the form's configured server as part of the package's core function.
- Private file uploads use the package API and a signed upload URL after a file is selected.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedrust_blur_lib/blur_bg.wasmView file
•path = rust_blur_lib/blur_bg.wasm
kind = wasm_module
sizeBytes = 16119
magicHex = [redacted]
Medium
package.jsonView file
•scripts changed=build
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgindex.jsView file
12import { version } from "./package.json";
import "./src/fingerprint";
import Dayjs from "vue-dayjs";
console.log("PROMO.DEV FORM BUILDER", ver
Findings
1 Critical6 Medium5 Low
CriticalManifest Confusionpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulerust_blur_lib/blur_bg.wasm
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceindex.js
MediumAi Review Evidencesrc/fingerprint.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to lucien-form-builder@2.9.0.
See all versions of lucien-form-builder for other recorded verdicts.
- Review the evidence and your use of lucien-form-builder@2.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.