rozmova-analytics@1.1.67
A collection of JavaScript functions for Rozmova analytics
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe manifest has no lifecycle hook, and the inspected runtime bundle sends analytics and attribution data to analytics providers and package-aligned service endpoints. The observed collection and transmission are consistent with the package's analytics function, with no concrete attack behavior established.
Decision evidence
public snapshot- package.json exposes the dist entrypoints and declares analytics-related dependencies; it has no install or runtime lifecycle hook.
- The UMD bundle configures Mixpanel with the package's analytics endpoint and tracks page views when init runs.
- Event tracking forwards events to Mixpanel and Customer.io, matching the package's analytics purpose.
- The first-party event method posts event data and attribution to a Rozmova or Clearly analytics endpoint.
- Collected common parameters include attribution, browser, device, URL, and analytics identifiers.
Source & flagged code
6 flaggedpackage.json exposes the dist entrypoints and declares analytics-related dependencies; it has no install or runtime lifecycle hook.
package.jsonView on unpkg · L7package.json exposes the dist entrypoints and declares analytics-related dependencies; it has no install or runtime lifecycle hook.
package.jsonView on unpkg · L46Findings
Affected versions and remediation
This report applies to rozmova-analytics@1.1.67.
See all versions of rozmova-analytics for other recorded verdicts.
- Review the evidence and your use of rozmova-analytics@1.1.67 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.