registry / rozmova-analytics / 1.1.69
rozmova-analytics@1.1.69
A collection of JavaScript functions for Rozmova analytics
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe source shows an analytics library whose tracking is activated through its exported API and whose Mixpanel token is used for Mixpanel service requests. Network and environment signals align with analytics behavior, and no concrete attack behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls the exported analytics initialization or tracking methods.
Impact
The inspected behavior supports the package's stated analytics purpose and does not establish unrelated credential theft or other attack behavior.
Mechanism
Initialization configures Mixpanel with its project token and analytics host; tracking methods send attribution and event data to configured analytics services.
AI rationale
The source shows an analytics library whose tracking is activated through its exported API and whose Mixpanel token is used for Mixpanel service requests. Network and environment signals align with analytics behavior, and no concrete attack behavior was identified.
Network endpoints6
api-eu.mixpanel.comcdp-eu.customer.iotrp.clearly.helptrp.rozmova.mestage.trp.clearly.helpstage.trp.rozmova.me
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to library entrypoints and declares no install lifecycle hooks; its dependencies are browser analytics, cookie, ID, and consent libraries.
- The wrapper initializes Mixpanel from its exported init method, sets a Mixpanel project token and EU API host, and offers caller configuration overrides.
- The Mixpanel SDK sends its project token in a Basic authorization header to its configured settings route; this is service authentication for remote settings, not collection of a consumer credential.
- The wrapper builds analytics attribution from campaign, session, browser, device, and analytics identifiers and sends first-party events to Rozmova endpoints.
- The inspected dependency entry files show browser SDK, cookie handling, and ID generation behavior; no unrelated credential harvesting or attack behavior was identified.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinified
Source & flagged code
6 flaggedpackage.jsonView file
9dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"import": {
"types": "./dist/index.d.ts",
Low
Suspicious Lifecycle Evidence
The manifest points to library entrypoints and declares no install lifecycle hooks; its dependencies are browser analytics, cookie, ID, and consent libraries.
package.jsonView on unpkg · L9.lpm-dependency-evidence-d857b120-4fff-4c63-9d96-18938078ab12/1/npm-linux/dist/mixpanel.min.jsView file
175c=this;if(!n.AbortController)return w.i("Remote settings unavailable: missing minimum required APIs"),b(),Promise.resolve();var d=this.ja("settings")+"/"+this.g("api_routes").setti
Medium
Stripped Provenance Metadata
The Mixpanel SDK sends its project token in a Basic authorization header to its configured settings route; this is service authentication for remote settings, not collection of a consumer credential.
.lpm-dependency-evidence-d857b120-4fff-4c63-9d96-18938078ab12/1/npm-linux/dist/mixpanel.min.jsView on unpkg · L175Findings
3 Medium9 Low
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadata.lpm-dependency-evidence-d857b120-4fff-4c63-9d96-18938078ab12/1/npm-linux/dist/mixpanel.min.js
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-d857b120-4fff-4c63-9d96-18938078ab12/1/npm-linux/dist/mixpanel.cjs.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-d857b120-4fff-4c63-9d96-18938078ab12/1/npm-linux/dist/mixpanel.module.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-d857b120-4fff-4c63-9d96-18938078ab12/1/npm-linux/dist/mixpanel-recorder.js
LowSuspicious Dependency Evidence
Affected versions and remediation
This report applies to rozmova-analytics@1.1.69.
See all versions of rozmova-analytics for other recorded verdicts.
- Review the evidence and your use of rozmova-analytics@1.1.69 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.