registry / @ai2web/core / 0.4.0

@ai2web/core@0.4.0

AI2Web (ai2w) core - types, capability model, manifest builder, validation & AI Readiness scoring.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

A hostname that passes literal validation may resolve to a private/internal address. Calling discover() or executeOperation() can then fetch it and return its response.

Static reason

No blocking static signals were detected.

Trigger

Application calls discover() or executeOperation() with attacker-influenced manifest or operation URLs.

Impact

Potential access to internal HTTP services and disclosure of their responses.

Mechanism

DNS-rebinding-capable SSRF through hostname-only URL validation.

Rationale

No malicious install-time or persistence behavior was found, but the exported SSRF guard has a concrete hostname-resolution bypass on attacker-influenced URLs. This is a security vulnerability rather than evidence of malicious intent.

Evidence

dist/safety.jsdist/discover.jsdist/execute.jspackage.jsonREADME.mddist/index.jsdist/builder.jsdist/export.jsdist/negotiate.jsdist/schema.jsdist/validate.jsdist/badge.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with false-positive risk.

low

Evidence for warning

dist/safety.js permits hostnames without DNS/IP resolution checks.
safeFetch() fetches allowed hostname URLs and returns their responses.
dist/discover.js and dist/execute.js pass manifest-controlled URLs to safeFetch().

Evidence against

package.json has no lifecycle hooks or dependencies.
No filesystem writes, shell execution, dynamic code loading, or persistence found.
Redirects are manually validated and cross-origin auth/cookie headers are stripped.
High-risk operations return a preview pending approval.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 24.2 KB of source

Source & flagged code

2 flagged

dist/safety.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/safety.js permits hostnames without DNS/IP resolution checks.

dist/safety.jsView on unpkg

dist/discover.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/discover.js and dist/execute.js pass manifest-controlled URLs to safeFetch().

dist/discover.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/safety.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/safety.js permits hostnames without DNS/IP resolution checks.

dist/safety.jsView on unpkg

dist/discover.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/discover.js and dist/execute.js pass manifest-controlled URLs to safeFetch().

dist/discover.jsView on unpkg

Findings

3 Medium2 Low

MediumAi Review Evidencedist/safety.js

MediumAi Review Evidence

MediumAi Review Evidencedist/discover.js

LowScripts Present

LowHigh Entropy Strings

LPM CLI

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact39.4 KB · 24 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build

Behavioral surface

Source: cleanHighEntropyStringsManifest: clean

Source & flagged code

2 flagged

dist/safety.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/safety.js permits hostnames without DNS/IP resolution checks.

dist/safety.jsView on unpkg

dist/discover.jsView file

•Published source reference

Medium

Ai Review Evidence

dist/discover.js and dist/execute.js pass manifest-controlled URLs to safeFetch().

dist/discover.jsView on unpkg