registry / @bcrumbs.net/inbox / 0.0.60

@bcrumbs.net/inbox@0.0.60

Inbox widget for Bread Crumbs portals

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A bundled Azure Blob credential permits anonymous blob read/create until late 2027. It is used only when a user selects a chat attachment; no install-time attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

User selects an attachment in the inbox UI.

Impact

Unauthorized storage creation and potential access to known blob paths while the SAS remains valid.

Mechanism

Embedded Azure SAS uploads selected files to a public blob container.

Rationale

The package is not malicious by observed behavior, but shipping a reusable anonymous read/create storage credential is a significant security flaw that warrants a warning.

Evidence

package.jsonindex.cjs.jsindex.esm.jsREADME.md

Network endpoints1

bcuserres.blob.core.windows.net

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

index.cjs.js embeds a long-lived Azure Blob SAS with read/create permissions.

@bcrumbs.net/inbox@0.0.60

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code