registry / rozmova-analytics / 1.1.64
rozmova-analytics@1.1.64
A collection of JavaScript functions for Rozmova analytics
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected entrypoints implement package-aligned browser analytics, and the manifest provides no automatic installation attack path. The consent callback contains a privacy defect, but the source does not establish malicious behavior or credential exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Caller invocation of initialization and tracking methods activates analytics.
Impact
Analytics data is collected and transmitted; rejecting the displayed consent option incorrectly grants Google tracking consent. No credential theft, host-file mutation, or malicious execution was established.
Mechanism
The library reads attribution cookies and browser metadata, loads Customer.io, and sends analytics events through SDKs or fixed first-party endpoints.
AI rationale
Inspected entrypoints implement package-aligned browser analytics, and the manifest provides no automatic installation attack path. The consent callback contains a privacy defect, but the source does not establish malicious behavior or credential exfiltration.
Network endpoints7
trp.clearly.helptrp.rozmova.mestage.trp.clearly.helpstage.trp.rozmova.meapi-eu.mixpanel.comcdp-eu.customer.iocdn.jsdelivr.net
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has development scripts but no automatic install lifecycle hooks or runtime self-dependency.
- Analytics initialization loads Customer.io through a caller-invoked init method.
- First-party analytics destinations are selected from fixed Rozmova and Clearly hosts.
- The ESM entrypoint posts caller-provided events and exports an Analytics instance without calling init.
- Event tracking uses the Mixpanel SDK, consistent with the package's analytics purpose.
- The cookie-consent rejection callback incorrectly grants Google tracking consent; this is a privacy defect without evidence of malware intent.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
46"scripts": {
"prebuild": "rm -rf dist",
"build": "tsup",
"dev": "tsup --watch",
"clean": "rm -rf dist",
"check": "biome check ./src",
"check:fix": "biome check --writ
Low
Suspicious Lifecycle Evidence
package.json has development scripts but no automatic install lifecycle hooks or runtime self-dependency.
package.jsonView on unpkg · L46dist/index.cjsView file
690async init({
env,
locale,
platform,
isClearly,
config,
mixpanelConfig = {}
} = {}) {
insertCustomerIOScript();
storeGeoParam();
const userId = getUserId();
if (
Low
Ai Review Evidence
Analytics initialization loads Customer.io through a caller-invoked init method.
dist/index.cjsView on unpkg · L690259var getAPIEndpoint = (isProd, isClearly, endpoint) => {
const baseURL = isProd ? isClearly ? "https://trp.clearly.help" : "https://trp.rozmova.me" : isClearly ? "https://stage.trp.clearly.help" : "https://stage.trp.rozmova.me";
return baseURL + endpoint;
};
var isNewSession = (prevSessionIdKey) => {
con
Findings
2 Medium10 Low
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.cjs
LowAi Review Evidencedist/index.cjs
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.cjs
LowAi Review Evidencedist/index.cjs
Affected versions and remediation
This report applies to rozmova-analytics@1.1.64.
See all versions of rozmova-analytics for other recorded verdicts.
- Review the evidence and your use of rozmova-analytics@1.1.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.