registry / woo-elevell / 0.91.0
woo-elevell@0.91.0
\# woo-elevell SDK — Complete Developer Documentation
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected entry points and call sites show a WooCommerce SDK using a configured same-origin store gateway, optional Razorpay checkout, and build-time manifest generation. These behaviors fit the package’s stated purpose, and I found no unrelated data collection or other attack behavior.
Static reason
No blocking static signals were detected.
Trigger
Store requests occur when SDK actions are invoked; Razorpay loads during the payment flow; source scanning and manifest generation run during a Vite build.
Impact
These operations support normal store interactions, payment checkout, and build-time integration; no unrelated collection or destructive behavior was found.
Mechanism
The SDK posts to its configured gateway using same-origin credentials. The build integration reads template source and package metadata to produce a manifest.
AI rationale
The inspected entry points and call sites show a WooCommerce SDK using a configured same-origin store gateway, optional Razorpay checkout, and build-time manifest generation. These behaviors fit the package’s stated purpose, and I found no unrelated data collection or other attack behavior.
Evidence
src/**/*.{js,jsx,ts,tsx} (read during build)package.json (read during build)elevell-manifest.json (generated build asset)
Network endpoints2
/wp-json/elevell/v1/store (relative path; host is runtime-configured)checkout.razorpay.com/v1/checkout.js
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a React/WooCommerce SDK and a Vite build integration.
- Store requests use a configurable gateway URL, defaulting to a relative WordPress route, with same-origin credentials.
- The Vite integration reads template source and package metadata to generate a build manifest.
- The payment hook loads Razorpay’s official checkout script when its payment flow is used.
Evidence against
Behavioral surface
FilesystemNetwork
UrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
1{
"name": "woo-elevell",
"version": "0.91.0",
"type": "module",
"main": "src/index.js",
"exports": {
".": "./src/index.js",
"./vite": "./src/vite.js",
"./routes": "./sr
Low
Ai Review Evidence
The manifest exposes a React/WooCommerce SDK and a Vite build integration.
package.jsonView on unpkg · L1src/client.jsView file
119bort(), timeout) : null;
let response;
try {
response = await fetch(url, {
method: "POST",
headers,
credentials: "same-origin",
body: JSON.stringify({ action, params }),
signal: controller ?
Low
Ai Review Evidence
Store requests use a configurable gateway URL, defaulting to a relative WordPress route, with same-origin credentials.
src/client.jsView on unpkg · L1191const DEFAULT_CONFIG = {
gatewayUrl: "/wp-json/elevell/v1/store",
nonce: null,
// Abort a request that the server never answers. Witho
Low
Findings
1 Medium9 Low
MediumNetwork
LowFilesystem
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencesrc/client.js
LowAi Review Evidencesrc/client.js
LowAi Review Evidencesrc/vite.js
LowAi Review Evidencesrc/vite.js
LowAi Review Evidencesrc/useOrderPay.js
Affected versions and remediation
This report applies to woo-elevell@0.91.0.
See all versions of woo-elevell for other recorded verdicts.
- Review the evidence and your use of woo-elevell@0.91.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.