registry / rozmova-analytics / 1.1.68
rozmova-analytics@1.1.68
A collection of JavaScript functions for Rozmova analytics
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the inspected runtime sends analytics data through the package’s analytics integrations when its client is initialized or events are submitted. These package-aligned behaviors do not establish a malicious attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer application initializes the exported analytics client or submits an analytics event.
Impact
Analytics event and attribution data is sent to those services; inspected source does not establish credential theft, unrelated data collection, or other attack behavior.
Mechanism
Initialization loads Customer.io analytics and configures Mixpanel; event calls forward event data to the enabled analytics services.
AI rationale
The manifest has no install lifecycle hooks, and the inspected runtime sends analytics data through the package’s analytics integrations when its client is initialized or events are submitted. These package-aligned behaviors do not establish a malicious attack surface.
Evidence
package.jsondist/index.jsdist/index.umd.js
Network endpoints2
api-eu.mixpanel.comcdp-eu.customer.io/v1/analytics-js/snippet/
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the distribution files as package entrypoints and declares no lifecycle hooks.
- Analytics setup runs through init and configures Mixpanel for event tracking at its European API host.
- Event tracking sends caller-provided event data to the configured analytics services; first-party tracking posts event data to the analytics endpoint.
- The UMD bundle contains the same Customer.io and Mixpanel analytics integrations.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
8"main": "./dist/index.cjs",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"import": {
"type
Low
Suspicious Lifecycle Evidence
The manifest exposes the distribution files as package entrypoints and declares no lifecycle hooks.
package.jsonView on unpkg · L8dist/index.jsView file
665async init({
env,
locale,
platform,
isClearly,
config,
mixpanelConfig = {}
} = {}) {
insertCustomerIOScript();
storeGeoParam();
const userId = getUserId();
if (isMetaBrowser()) {
setQueryParam(USER_ID_KEY, user
Low
Ai Review Evidence
Analytics setup runs through init and configures Mixpanel for event tracking at its European API host.
dist/index.jsView on unpkg · L665685mixpanel.init(MIXPANEL_TOKEN, {
debug: false,
track_pageview: "url-with-path",
// Native WebViews (capacitor://localhost) do not persist document.cookie, and with the
// CapacitorCookies plugin every cookie access is a synchronous native prompt() round
Findings
2 Medium10 Low
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.umd.js
Affected versions and remediation
This report applies to rozmova-analytics@1.1.68.
See all versions of rozmova-analytics for other recorded verdicts.
- Review the evidence and your use of rozmova-analytics@1.1.68 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.