rozmova-analytics@1.1.70
A collection of JavaScript functions for Rozmova analytics
AI Security Review
scanned 1d ago · by lpm-firewall-aiThis analytics package has a real consent-handling mismatch: initialization starts provider tracking without checking consent, while the banner describes tracking as requiring explicit consent and its rejection callback grants consent values. The collection serves the package's analytics purpose, so this supports a warning for telemetry rather than a malicious verdict.
Decision evidence
public snapshot- The cookie banner config sets the analytics category enabled by default.
- The analytics rejection callback sends Google consent values of granted.
- Calling init inserts the Customer.io analytics script and initializes Mixpanel without checking the consent choice.
- setUser supplies email, name, and phone fields to analytics identity APIs.
- The package describes itself as an analytics library, and the observed collection is directed to analytics providers or its first-party analytics API.
- The manifest declares no lifecycle scripts, and the entry point only starts collection when init is called.
Source & flagged code
5 flaggedThe cookie banner config sets the analytics category enabled by default.
dist/index.jsView on unpkg · L352The analytics rejection callback sends Google consent values of granted.
dist/index.jsView on unpkg · L368Calling init inserts the Customer.io analytics script and initializes Mixpanel without checking the consent choice.
dist/index.jsView on unpkg · L566Findings
Affected versions and remediation
This report applies to rozmova-analytics@1.1.70.
See all versions of rozmova-analytics for other recorded verdicts.
- Review the evidence and your use of rozmova-analytics@1.1.70 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.