sams-sr-sdk-h5
A utility package that reports runtime errors to Sentry using @sentry/node.
This report shows the evidence for sams-sr-sdk-h5@7.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiRuntime Sentry reporting can be package-aligned, but executing it automatically from preinstall with a hardcoded DSN and public-IP collection creates concrete unconsented install-time data exfiltration. This is sufficient to block despite the absence of broader credential or filesystem harvesting.
Decision evidence
public snapshot- package.json defines preinstall: npm install @sentry/node && node examples/verify.js
- examples/verify.js runs on install, calls init(), setUserFromPublicIp(), check(), and flush()
- src/index.js has a hardcoded default Sentry DSN to o4510485815754752.ingest.us.sentry.io
- src/index.js defaults sendDefaultPii: true and sends captured exceptions via Sentry.captureException
- examples/verify.js fetches https://www.cloudflare.com/cdn-cgi/trace before reporting
- No child_process use found in package source beyond manifest lifecycle command
- No filesystem read/write harvesting found in source
- Network behavior is framed as Sentry error reporting functionality, but it is also forced at install time
Source & flagged code
2 flagged · loading sourceInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to sams-sr-sdk-h5@7.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing sams-sr-sdk-h5@7.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.