registry / rozmova-analytics / 1.1.65
rozmova-analytics@1.1.65
A collection of JavaScript functions for Rozmova analytics
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected network and browser-storage behavior is consistent with the analytics API, with no concrete credential theft, install abuse, or malicious execution identified. The consent defect merits application-level correction but does not establish malware intent.
Static reason
One or more suspicious static signals were detected.
Trigger
The consuming application calls initialization, identification, or event-tracking methods.
Impact
Expected analytics collection occurs; the consent callback defect affects privacy preferences but does not establish a malicious package attack.
Mechanism
The library stores analytics identifiers, loads Customer.io, and sends analytics events to integrated services and fixed first-party endpoints.
AI rationale
Inspected network and browser-storage behavior is consistent with the analytics API, with no concrete credential theft, install abuse, or malicious execution identified. The consent defect merits application-level correction but does not establish malware intent.
Network endpoints6
trp.clearly.helptrp.rozmova.mestage.trp.clearly.helpstage.trp.rozmova.meapi-eu.mixpanel.comcdp-eu.customer.io/v1/analytics-js/snippet/
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has build and maintenance scripts, with no automatic install lifecycle hooks or runtime self-dependency.
- Analytics initialization is caller-invoked in both runtime entrypoints.
- First-party event requests use fixed Rozmova or Clearly production and staging hosts.
- Profile identification receives user data supplied by the caller.
- The dynamically loaded Customer.io script implements the package's analytics integration.
Evidence against
- The cookie-consent rejection callback grants Google tracking consent, a privacy implementation defect.
- Initialization enables third-party analytics, and callers can override Mixpanel configuration.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
46"scripts": {
"prebuild": "rm -rf dist",
"build": "tsup",
"dev": "tsup --watch",
"clean": "rm -rf dist",
"check": "biome check ./src",
"check:fix": "biome check --writ
Low
Suspicious Lifecycle Evidence
package.json has build and maintenance scripts, with no automatic install lifecycle hooks or runtime self-dependency.
package.jsonView on unpkg · L46dist/index.cjsView file
690async init({
env,
locale,
platform,
isClearly,
config,
mixpanelConfig = {}
} = {}) {
insertCustomerIOScript();
storeGeoParam();
const userId =
Low
Ai Review Evidence
Analytics initialization is caller-invoked in both runtime entrypoints.
dist/index.cjsView on unpkg · L690259var getAPIEndpoint = (isProd, isClearly, endpoint) => {
const baseURL = isProd ? isClearly ? "https://trp.clearly.help" : "https://trp.rozmova.me" : isClearly ? "https://stage.trp.clearly.help" : "https://stage.trp.rozmova.me";
return baseURL + endpoint;
};
var isNewSession = (prevSessionIdKey)
Findings
2 Medium10 Low
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.cjs
LowAi Review Evidencedist/index.cjs
LowAi Review Evidencedist/index.cjs
LowAi Review Evidencedist/index.cjs
LowAi Review Evidencedist/index.cjs
Affected versions and remediation
This report applies to rozmova-analytics@1.1.65.
See all versions of rozmova-analytics for other recorded verdicts.
- Review the evidence and your use of rozmova-analytics@1.1.65 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.