registry / 3d-template / 0.0.7

3d-template@0.0.7

> TODO: description

AI Security Review

scanned 14h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The browser component configures authenticated API calls for the selected deployment environment.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer mounts the exported browser component and invokes its application API actions.

Impact

Normal application API requests may carry the existing accesstoken cookie as an authorization header.

Mechanism

Authenticated Axios requests to the configured application API.

Rationale

The scanner finding reflects an Axios authentication interceptor, not a separate receiver or automatic data theft path. The package has no lifecycle hooks or other source evidence of malicious execution.

Network endpoints4

3d-test.onewo.com3d-login-test.onewo.com3d-login-fat.onewo.com3d-login.onewo.com

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for warning

The bundle configures development and login service hosts.
The browser bundle reads an accesstoken cookie and attaches it to Axios request headers.
The manifest exposes a browser bundle and contains no install lifecycle script.

Evidence against

Requests use the configured API base URL; the source contains no separate credential collection or exfiltration receiver.
The token handling is a conventional authenticated-request interceptor.
No child-process execution, dynamic code execution, filesystem access, or persistence behavior was found.

Behavioral surface

Source

Network

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 87.7 KB of source, external domains: 3d-login-fat.onewo.com, 3d-login-test.onewo.com, 3d-login.onewo.com, 3d-test.onewo.com

Source & flagged code

4 flagged

dist/index.umd.jsView file

Lines 284-357javascript

284 } else {

285 head.appendChild(style);

286 }

287 } else {

288 head.appendChild(style);

289 }

290

291 if (style.styleSheet) {

292 style.styleSheet.cssText = css;

293 } else {

294 style.appendChild(document.createTextNode(css));

295 }

296 }

297

298 var css = "html,\nbody,\n#root {\n height: 100%;\n}\n\n.ant-layout-header {\n background: #fff !important;\n}\n";

299 styleInject(css);

300

301 var protocol = window.location.protocol;

302 var host = window.location.host;

303 var serverURL = "".concat(protocol, "//").concat(host);

304 var DEV_SERVER_URL = "http://3d-test.onewo.com";

305 var envConstant = [{

306 BASEURL: "".concat(DEV_SERVER_URL, "/api"),

307 // 基础接口路径

308 REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径

309 }, {

310 BASEURL: "".concat(serverURL, "/api"),

311 REDIRECTURL: "http://3d-login-fat.onewo.com"

312 }, {

313 BASEURL: "".concat(serverURL, "/api"),

314 REDIRECTURL: "https://3d-login.onewo.com"

315 }];

Medium

Ai Review Evidence

The bundle configures development and login service hosts.

dist/index.umd.jsView on unpkg · L304

316 function checkEnv() {

317 switch (host) {

318 // 正式环境

319 case "3d.onewo.com":

320 return envConstant[2];

321 // fat测试环境

322 case "3d-fat.onewo.com":

323 return envConstant[1];

324 // dev开发环境

325 default:

326 return envConstant[0];

327 }

328 }

329

330 // 解析url.获得对应的参数

331 //判断是否是IE浏览器

332 function isIE() {

333 //ie?

334 if (!!window.ActiveXObject || "ActiveXObject" in window) return true;else return false;

335 }

336

337 axios.defaults.baseURL = checkEnv().BASEURL;

338 // 获取cookie

339 function getCookie(cname) {

340 var arr,

341 reg = new RegExp("(^| )" + cname + "=([^;]*)(;|$)");

342 // eslint-disable-next-line

343 if (arr = document.cookie.match(reg)) return arr[2];else return null;

344 }

345

346 // http request 拦截器

347 axios.interceptors.request.use(function (config) {

348 // 取accesstoken

Medium

Ai Review Evidence

The browser bundle reads an accesstoken cookie and attaches it to Axios request headers.

dist/index.umd.jsView on unpkg · L337

349 var accesstoken = getCookie("accesstoken");

350 // 设置request-header

351 if (accesstoken) {

352 config.headers["Authorization"] = accesstoken;

353 config.headers["Access-Control-Allow-Origin"] = "*";

354 config.headers["Access-Token"] = accesstoken;

355 }

356 if (config.method === "get" && isIE()) {

357 config.params = _objectSpread2({

•Browser cookie sent to a fixed external endpoint in dist/index.umd.js: /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.[redacted]-helpers/LICENSE */ var DEV_SERVER_URL = "http://3d-test.onewo.com"; REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径 REDIRECTURL: "http://3d-login-fat.onewo.com" REDIRECTURL: "https://3d-login.onewo.com" if (arr = document.cookie.match(reg)) return arr[2];else return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.umd.jsView on unpkg

package.jsonView file

Lines 1-14json

2 "name": "3d-template",

3 "version": "0.0.7",

4 "description": "> TODO: description",

5 "main": "dist/index.umd.min.js",

Source & flagged code

4 flagged · loading source

dist/index.umd.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.umd.jsView on unpkg

304var DEV_SERVER_URL = "http://3d-test.onewo.com"; var envConstant = [{ BASEURL: "".concat(DEV_SERVER_URL, "/api"), // 基础接口路径 REDIRECTURL: "http://3d-login-test.onewo.com" // 登录过期重定向路径 }, { BASEURL: "".concat(serverURL, "/api"), REDIRECTURL: "http://3d-login-fat.onewo.com" }, { BASEURL: "".concat(serverURL, "/api"), REDIRECTURL: "https://3d-login.onewo.com" }];

Medium

Ai Review Evidence

The bundle configures development and login service hosts.

dist/index.umd.jsView on unpkg · L304

337axios.defaults.baseURL = checkEnv().BASEURL; // 获取cookie function getCookie(cname) { var arr, reg = new RegExp("(^| )" + cname + "=([^;]*)(;|$)"); // eslint-disable-next-line if (arr = document.cookie.match(reg)) return arr[2];else return null; } // http request 拦截器 axios.interceptors.request.use(function (config) { // 取accesstoken var accesstoken = getCookie("accesstoken"); // 设置request-header if (accesstoken) { config.headers["Authorization"] = accesstoken; config.headers["Access-Control-Allow-Origin"] = "*"; con

Findings

1 Critical4 Medium1 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.umd.js

MediumNetwork

MediumAi Review Evidencedist/index.umd.js

MediumSuspicious Lifecycle Evidencepackage.json

LowUrl Strings