templates-common-library@0.0.726
Contains reusable utilities for all ArcGIS Instant apps
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source implements application-configured runtime analytics and includes identifying page details in its payloads. Because consent can be disabled by configuration, this merits a warning for privacy risk; the source does not show an install-time or concealed collection path.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An application initializes the exported telemetry utility with analytics enabled; consent is not required unless configured.
Impact
Page host and browsing details may be disclosed to analytics providers without an explicit consent prompt.
Mechanism
The utility builds page and event payloads containing browser page metadata and passes them to configured analytics providers.
AI rationale
The source implements application-configured runtime analytics and includes identifying page details in its payloads. Because consent can be disabled by configuration, this merits a warning for privacy risk; the source does not show an install-time or concealed collection path.
Evidence
structuralFunctionality/telemetry/telemetry.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Telemetry payloads include the browser page hostname, path, referrer, and title.
- The module initializes analytics providers using application-supplied settings.
- Consent is required only when the application sets googleAnalyticsConsent to true.
Evidence against
- The telemetry module is an exported utility rather than an install hook.
- When consent is required and has not been given, telemetry initialization waits.
Behavioral surface
Network
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggedstructuralFunctionality/telemetry/telemetry.jsView file
20contains invisible/control Unicode U+200B (zero width space)
limitations under the License.<U+200B>
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
structuralFunctionality/telemetry/telemetry.jsView on unpkg · L20413formatPayload(page, previousPage, options, eventType) {
const { referrer, title } = document || {};
const { hostname, pathname } = window && window.location
? window.location
: { hostname: null, pathname: null };
return {
eventType,
r
Medium
Ai Review Evidence
Telemetry payloads include the browser page hostname, path, referrer, and title.
structuralFunctionality/telemetry/telemetry.jsView on unpkg · L413107// Adobe Launch (custom wrapper)
this._adobeTracker = await this._loadAdobeAnalytics(settings);
const plugins = [];
const amazonOptions = this._getAmazonOptions(settings);
if (amazonOptions) {
plugins.push(new Amazon(amazonOptions));
}
const googleAnalyticsOptions = this._getGoogleAnalyticsOptions(settings);
if (isGoogleEnabled && googleAnaly
Findings
1 Critical5 Medium4 Low
CriticalTrojan Source UnicodestructuralFunctionality/telemetry/telemetry.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review EvidencestructuralFunctionality/telemetry/telemetry.js
MediumAi Review EvidencestructuralFunctionality/telemetry/telemetry.js
MediumAi Review EvidencestructuralFunctionality/telemetry/telemetry.js
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to templates-common-library@0.0.726.
See all versions of templates-common-library for other recorded verdicts.
- Review the evidence and your use of templates-common-library@0.0.726 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.