registry / Data exfiltration / spf-analytics
spf-analytics
Storefront analytics loader.
This report shows the evidence for spf-analytics@1.0.0, the only known version.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe published entrypoint silently forwards checkout PII to a hardcoded third-party webhook after encrypting it for the package operator. Obfuscation and the analytics label conceal that collection rather than document a user-controlled analytics client.
Static reason
One or more suspicious static signals were detected.
Trigger
The script runs when included as the package main entry, then sends data when the page dispatches the decoded window event.
Impact
Shopper names, phones, emails, shipping addresses, and order details are disclosed to the webhook operator, who alone can decrypt them.
Mechanism
It normalizes phone, email, and address fields, fingerprints them in localStorage, wraps the payload with RSA-OAEP and AES-GCM, and fetch-posts the ciphertext to https://connector.internalwebhooks.com/spf-analytics.
Attack narrative
When a storefront loads spf-analytics, the obfuscated script arms a window listener. On the matching checkout event it copies the shopper phone, email, and address plus order lines, encrypts that object with an embedded RSA key, and posts it to connector.internalwebhooks.com. A localStorage fingerprint cache suppresses repeats. The analytics name and missing install hooks do not change the hidden collection and off-site delivery.
AI rationale
The published entrypoint silently forwards checkout PII to a hardcoded third-party webhook after encrypting it for the package operator. Obfuscation and the analytics label conceal that collection rather than document a user-controlled analytics client.
Evidence
package.jsonindex.js
Network endpoints1
connector.internalwebhooks.com/spf-analytics
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json points main at index.js and sets sideEffects true, with no install lifecycle scripts, so the loader runs when a page includes the script.
- The obfuscated loader requires a phone, keeps a fingerprint cache, and takes its endpoint and public key from the hidden string table.
- Checkout parsing keeps a 10-digit phone that must start with 6-9, plus email, name, and full address fields.
- The collected address, order, and context are encrypted with an embedded RSA public key and AES-GCM, then posted with fetch to https://connector.internalwebhooks.com/spf-analytics.
- A window listener forwards events into that sender, and the string table contains gokwik_events.
Evidence against
- There are no preinstall, install, or postinstall hooks and no shell, eval, or environment harvesting.
- The request credentials value is chosen from the string table, which includes omit, so this posts a body rather than stealing cookies.
Behavioral surface
HighEntropyStrings
Source & flagged code
7 flagged · loading sourceindex.jsView file
1function _0x59a8(_0x4ae22c,_0x241236){_0x4ae22c=_0x4ae22c-0xce;const _0x342a1a=_0x342a();let _0x59a82b=_0x342a1a[_0x4ae22c];return _0x59a82b;}(function(_0x19bc0b,_0x30f079){const _...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.jsView on unpkg · L11'endpoint':_0x504976[_0x490e7e(0x156)],'publicKeyPem':_0x490e7e(0xf2),'requirePhone':!![],'storageKey':_0x504976[_0x490e7e(0x14f)],'maxRememberedFingerprints':0x1f4,'maxLineItems':
High
Ai Review Evidence
The obfuscated loader requires a phone, keeps a fingerprint cache, and takes its endpoint and public key from the hidden string table.
index.jsView on unpkg · L11if(/^(\d)\1{9}$/[_0x466fc2(0xed)](_0x2ef2e6))return'';if(!/^[6-9]/[_0x466fc2(0xed)](_0x2ef2e6))return'';return _0x2ef2e6;}function _0x6ab098(_0x3d4ea2){const _0
High
Ai Review Evidence
Checkout parsing keeps a 10-digit phone that must start with 6-9, plus email, name, and full address fields.
index.jsView on unpkg · L1Findings
8 High1 Medium3 Low
HighObfuscated Payload Loaderindex.js
HighObfuscated
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to spf-analytics@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing spf-analytics@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.