registry  /  @adguard/dnr-rulesets  /  3.3.20260714200046

@adguard/dnr-rulesets@3.3.20260714200046

Utility to create AdGuard DNR rulesets for mv3 extensions

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A bundled local browser script rule can intercept dynamically constructed page code and submit page-derived form data. It handles `window.api_key` and posts to a page-derived destination, but is not executed during npm installation or ordinary package import.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consuming browser extension selects and executes the matching rule on a web page.
Impact
May forward page-held API-key data to a page-derived remote endpoint in an extension runtime.
Mechanism
Proxy-based browser script interception with XHR form submission.
Rationale
No install-time, import-time, host-harvesting, or package-controlled exfiltration chain was found. The bundled browser rule remains a concrete risky capability that warrants warning rather than a publish block.
Evidence
package.jsondist/filters/local_script_rules.jsdist/lib/index.jsdist/cli.cjs
Network endpoints1
/check.php

Decision evidence

public snapshot
AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • `dist/filters/local_script_rules.js` includes a browser rule that proxies `Function` construction.
  • That rule reads `window.api_key` and XHR-posts a generated form to decoded `window.ext_site`.
  • The same rule sends a POST to relative `/check.php` before submitting the form.
  • The bundled rule set can alter browser-page globals and navigation when a consumer executes a matching rule.
Evidence against
  • `package.json` has no preinstall, install, postinstall, prepare, or publish lifecycle hook.
  • `dist/filters/local_script_rules.js` only exports a rule map; package import does not automatically execute it.
  • The post destination is derived from the visited page, not a fixed package-author host.
  • `dist/cli.cjs` downloads filters only through explicit `load` or `watch --latest-filters` commands.
Behavioral surface
Source
ChildProcessCryptoFilesystemNetwork
Supply chain
HighEntropyStringsTelemetryUrlStrings
Manifest
CopyleftLicense
scanned 3 file(s), 2.30 MB of source, external domains: af.gog.com, dai.google.com, file-upload.org, filters.adtidy.org, foo.com, future-sale-system.de, googleads.g.doubleclick.net, pubads.g.doubleclick.net, securepubads.g.doubleclick.net, www.facebook.com, www.gog.com, www.iab.net, www.ndtv.com, www.wp.pl
Oversized source lightweight scan
dist/cli.cjs4.64 MB file, sampled 256 KB
FilesystemNetworkCrypto

Source & flagged code

5 flagged · loading source
dist/lib/index.jsView file
10import { fileURLToPath } from 'node:url'; L11: import axios from 'axios'; L12: import fastGlob from 'fast-glob'; ... L951: var reservedWords = { L952: 3: "abstract boolean byte char class double enum export extends final float goto implements import int interface long native package private protected public short static super syn... L953: 5: "class enum extends super const export import", ... L1000: if (code <= 0xffff) { L1001: return code >= 0xaa && nonASCIIidentifierStart.test(String.fromCharCode(code)); L1002: } ... L8241: start: S.token, L8242: body: block_(), L8243: end: prev()
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/index.jsView on unpkg · L10
dist/filters/local_script_rules.jsView file
1export const localScriptRules = { L2: '(function(){var a=document.currentScript,b=String.prototype.charCodeAt,c=function(){return true;};Object.defineProperty(String.prototype,"charCodeAt",{get:function(){return docume... L3: try { ... L378: }, L379: "document.addEventListener('click',function(e){var t=e.target.closest('.click_coupons_code');if(!t)return;e.stopPropagation();e.preventDefault();var u=t.dataset.hrefAlt||null;if(u)... L380: try { ... L446: }, L447: '!function(){const p={apply:(p,e,n)=>{const r=Reflect.apply(p,e,n),s=r?.[0]?.props?.data;return s&&null===s.user&&(r[0].props.data.user="guest"),r}};window.JSON.parse=new Proxy(win... L448: try { ... L780: }, L781: "(()=>{const e=function(){};window.tC={privacy:{getOptinCategories:e,cookieData:[]},addConsentChangeListener:e,removeConsentChangeListener:e,container:{reload:e}},window.tc_events_... L782: try {
Critical
Global Object Hijack Exfiltration

Source reassigns a global/builtin to a Proxy that forwards intercepted runtime data to an external endpoint.

dist/filters/local_script_rules.jsView on unpkg · L1
dist/re2.wasmView file
•path = dist/re2.wasm kind = wasm_module sizeBytes = 892736 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

dist/re2.wasmView on unpkg
dist/cli.cjsView file
•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 4866096 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg
•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 4866096 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg

Findings

1 Critical1 High4 Medium7 Low
CriticalGlobal Object Hijack Exfiltrationdist/filters/local_script_rules.js
HighOversized Source Filedist/cli.cjs
MediumNetwork
MediumShips Wasm Moduledist/re2.wasm
MediumOversized Cli Entrypointdist/cli.cjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/lib/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowCopyleft License