@0xchain/request@1.1.0-beta.113
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe wrapper automatically forwards request and response content in error logs to the configured app logger, without an evident disclosure or opt-in. The endpoint is app-configured and the behavior is limited to errors, so this is suspicious runtime telemetry rather than clear malicious exfiltration.
Decision evidence
public snapshot- On request errors, the wrapper builds diagnostic details containing request parameters, request body, and response data.
- Timeout and server errors send these details to the logger; business errors also include request parameters and body.
- The logger POSTs its messages to `${NEXT_PUBLIC_APP_URL}/api/logger` automatically.
- Logging is limited to request errors and business errors, which is consistent with API diagnostics.
- The log host comes from the app URL environment setting; no unrelated hard-coded collector or install hook was found.
- The wrapper uses configured API and auth URLs to make requests and refresh tokens as part of its stated function.
Source & flagged code
5 flaggedOn request errors, the wrapper builds diagnostic details containing request parameters, request body, and response data.
dist/index.jsView on unpkg · L177Timeout and server errors send these details to the logger; business errors also include request parameters and body.
dist/index.jsView on unpkg · L197Timeout and server errors send these details to the logger; business errors also include request parameters and body.
dist/index.jsView on unpkg · L322Findings
Affected versions and remediation
This report applies to @0xchain/request@1.1.0-beta.113.
See all versions of @0xchain/request for other recorded verdicts.
- Review the evidence and your use of @0xchain/request@1.1.0-beta.113 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.