registry / woo-elevell / 0.8.0
woo-elevell@0.8.0
React SDK for Elevell storefront templates.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the inspected network operations align with its storefront and payment functionality. No concrete malicious behavior was established.
Static reason
No blocking static signals were detected.
Trigger
A consumer invokes a store API request or starts payment through the corresponding helper.
Impact
The inspected behavior does not establish an unrelated data collection or execution surface.
Mechanism
Requests post action parameters to the configured gateway with same-origin credentials; payment loads Razorpay's checkout script.
AI rationale
The package has no install lifecycle hook, and the inspected network operations align with its storefront and payment functionality. No concrete malicious behavior was established.
Evidence
package.jsonsrc/client.jssrc/useOrderPay.js
Network endpoints1
checkout.razorpay.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a JavaScript library entrypoint and lists only a peer dependency and a parser dependency; it has no lifecycle script.
- API requests use the configured store gateway, optionally attach the WordPress REST nonce, and send with same-origin credentials.
- Razorpay's checkout script is loaded when the payment helper runs.
Evidence against
Behavioral surface
FilesystemNetwork
UrlStrings
NoLicense
Source & flagged code
3 flaggedpackage.jsonView file
1{
"name": "woo-elevell",
"version": "0.8.0",
"type": "module",
"main": "src/index.js",
"exports": {
".": "./src/index.js",
"./vite": "./src/vite.js",
"./routes": "./src/routes.js"
},
"peerDependencies": {
"react": ">=18"
},
"dependencies": {
"@babel/parser": "^7.29.9"
}
}
Low
Suspicious Lifecycle Evidence
package.json defines a JavaScript library entrypoint and lists only a peer dependency and a parser dependency; it has no lifecycle script.
package.jsonView on unpkg · L1src/client.jsView file
108if (runtime.config.nonce) {
headers["X-WP-Nonce"] = runtime.config.nonce;
}
const response = await fetch(url, {
method: "POST",
headers,
credentials: "same-origin",
body: JSON.stringify({ action, pa
Low
Ai Review Evidence
API requests use the configured store gateway, optionally attach the WordPress REST nonce, and send with same-origin credentials.
src/client.jsView on unpkg · L108src/useOrderPay.jsView file
Findings
1 Medium6 Low
MediumNetwork
LowFilesystem
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/client.js
LowAi Review Evidencesrc/useOrderPay.js
Affected versions and remediation
This report applies to woo-elevell@0.8.0.
See all versions of woo-elevell for other recorded verdicts.
- Review the evidence and your use of woo-elevell@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.