sf-i-events@1.0.1170

Superflows Navigation Component

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The entrypoint has no install hook, and the inspected credential use is tied to the component’s calendar request. Static alerts point to a normal calendar service call, a declared fs dependency without observed source use, and an inert reporting template.

Static reason

One or more suspicious static signals were detected.

Trigger

The user returns from calendar mapping to the calendar view.

Impact

The request retrieves calendar data for display; the inspected source does not show unrelated collection or credential forwarding to a separate recipient.

Mechanism

The component posts the selected project identifier to the calendar endpoint and supplies the app’s email and access token as request authentication.

AI rationale

Evidence

package.jsonsf-i-events.jssrc/util.ts.lpm-inspection-2LWYmr/0-aafced95d2d3.txt

Network endpoints1

3mefupehxkw4pwsq3oyk7lf2pq0pisdx.lambda-url.us-east-1.on.aws

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies sf-i-events.js as the module entrypoint and contains no install lifecycle hook.
The bundled calendar feature posts the selected project’s calendar request to its calendar service.
The calendar request uses the app’s email and access token as authentication; the shared helper sends them in an Authorization header with the POST.
The bundled component calls the calendar fetch when the user returns from calendar mapping.
The inspected document is a DOCX reporting template with no analysis limitations; it is inert data in the reviewed source.

Evidence against

package.json declares an fs dependency, but the inspected source does not use it; this matches a static name-based dependency alert rather than observed behavior.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

Source & flagged code

6 flagged

dev/templates/table-template.docxView file

•path = dev/templates/table-template.docx kind = high_entropy_blob sizeBytes = 5507 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dev/templates/table-template.docxView on unpkg

•path = dev/templates/table-template.docx kind = compressed_blob sizeBytes = 5507 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dev/templates/table-template.docxView on unpkg

•path = dev/templates/table-template.docx kind = nested_archive_needs_inspection sizeBytes = 5507 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dev/templates/table-template.docxView on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

2"name": "sf-i-events", "private": false, "version": "1.0.1170", "description": "Superflows Navigation Component", "main": "sf-i-events.js", "module": "sf-i-events.js", "type": "mod

Low

Suspicious Lifecycle Evidence

package.json identifies sf-i-events.js as the module entrypoint and contains no install lifecycle hook.

package.jsonView on unpkg · L2

9"scripts": { "build": "tsc", "build:watch": "tsc --watch", "clean": "rimraf sf-i-events.{d.ts,d.ts.map,js,js.map} test/sf-i-events.{d.ts,d.ts.map,js,js.map} test/sf-i-events_test.{d.ts,d.ts.map,js,js.map}", "lint": "npm run lint:lit-analyzer && npm run lint:eslint", "lint:eslint": "eslint 'src/**/*.ts'", "lint:lit-analyzer": "lit-analyzer", "format": "prettier \"**/*.{cjs,html,js,json,md,ts}\" --ignore-path ./.eslintignore --write", "analyze": "cem analyze --litelement --globs \"src/**/*.ts\""

Low

Suspicious Lifecycle Evidence

package.json identifies sf-i-events.js as the module entrypoint and contains no install lifecycle hook.

package.jsonView on unpkg · L9

Source & flagged code

6 flagged · loading source

dev/templates/table-template.docxView file

•path = dev/templates/table-template.docx kind = high_entropy_blob sizeBytes = 5507 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dev/templates/table-template.docxView on unpkg

•path = dev/templates/table-template.docx kind = compressed_blob sizeBytes = 5507 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dev/templates/table-template.docxView on unpkg

•path = dev/templates/table-template.docx kind = nested_archive_needs_inspection sizeBytes = 5507 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dev/templates/table-template.docxView on unpkg

Findings

2 High4 Medium6 Low

HighShips High Entropy Blobdev/templates/table-template.docx

HighNode Builtin Dependency Squatpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdev/templates/table-template.docx

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondev/templates/table-template.docx

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to sf-i-events@1.0.1170.

See all versions of sf-i-events for other recorded verdicts.

Review the evidence and your use of sf-i-events@1.0.1170 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 15:09:36.435Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code