registry / @cocreate/url-uploader / 1.2.0

@cocreate/url-uploader@1.2.0

A simple url-uploader component in vanilla javascript. Easily configured using HTML5 data-attributes and/or JavaScript API.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Runtime socket clients can supply an arbitrary URL that the server fetches. The response body is returned to the client over the socket, creating an SSRF-style data retrieval primitive.

Static reason

No blocking static signals were detected.

Trigger

A connected client emits the `importUrl` socket event with `data.file.src`.

Impact

A client may access and receive content from network resources reachable by the host process.

Mechanism

Unvalidated server-side fetch and socket response relay.

Rationale

The source does not show malicious installation-time behavior or stealthy payload execution, but it exposes an unguarded server-side URL fetch that relays fetched data to clients. This is a concrete dangerous capability requiring a warning.

Evidence

package.jsonsrc/index.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`src/index.js` fetches caller-controlled `data.file.src` without URL validation.
The fetched response is base64-encoded and returned through the requesting socket.
This permits runtime retrieval of arbitrary reachable HTTP resources.

@cocreate/url-uploader@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code