3d-template@0.0.8

High-risk behavior combination matched malicious policy.

A consumer renders the exported browser component and uses a role-management route on a host other than the two recognised Onewo hosts.

An access token from the consumer application's cookie jar can be disclosed to the external test API and used with role-management requests.

Hard-coded cross-origin API selection with automatic access-token header forwarding.

The bundle is a browser application rather than a generic template. On an unrecognised host it configures its API client for 3d-test.onewo.com, reads the accesstoken cookie, and attaches it to every client request. When the exported component is rendered and its administrator or role-management routes are used, it sends authenticated requests to that external service. This creates a concrete credential-disclosure path for consumers outside the intended Onewo deployment.

The hard-coded default external API host and automatic forwarding of a consumer access token form a concrete runtime credential-exfiltration path. The absence of lifecycle hooks limits the attack to runtime use but does not neutralize it.