registry / @golstats/gsc-strengths / 1.1.2

@golstats/gsc-strengths@1.1.2

Componente general fortalezas

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The imported Vue component performs authenticated GET requests for its displayed football-strength data and loads related image assets.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer imports and renders the component with player/team/season data.

Impact

Displays Golstats statistics and images; no package-side host mutation or data harvesting observed.

Mechanism

Vue component data retrieval through Axios GET requests

Rationale

The scanner's secret signal is an expired hard-coded JWT-like value used only as an Authorization header for the package's Golstats data requests. Direct source inspection found a package-aligned UI data flow and no concrete malicious behavior.

Evidence

package.jsondist/gsc-strengths.jsdist/gsc-strengths.umd.cjsREADME.md

Network endpoints5

5c9xc3gwh2.execute-api.us-east-2.amazonaws.comm9qip57rsh.execute-api.us-east-2.amazonaws.comapis.golstats.comdev-apis.golstats.comgolstatsimages.blob.core.windows.net

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/gsc-strengths.js embeds a JWT-like Authorization value, but its payload expiration is in 2021.

Evidence against

package.json has no preinstall, install, postinstall, or bin hook.
dist/gsc-strengths.js is a Vue UI component that fetches requested football-strength data and image assets.
All observed runtime requests target Golstats/AWS API or Golstats image hosts; no credential harvesting or unrelated exfiltration is present.
No child-process, filesystem mutation, eval execution, dynamic code loading, persistence, or AI-agent config writes were found.

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 207 KB of source, external domains: 5c9xc3gwh2.execute-api.us-east-2.amazonaws.com, apis.golstats.com, dev-apis.golstats.com, golstatsimages.blob.core.windows.net, m9qip57rsh.execute-api.us-east-2.amazonaws.com, www.w3.org

Source & flagged code

3 flagged

dist/gsc-strengths.umd.cjsView file

Lines 1-7javascript

1(function(B,i){typeof exports=="object"&&typeof module<"u"?i(exports,require("vue")):typeof define=="function"&&define.amd?define(["exports","vue"],i):(B=typeof globalThis<"u"?globalThis:B||self,i(B.GSCStrengths={},B.Vue))})(this,function(B,i){"use strict";function Dt(t,e){return function(){return t.apply(e,arguments)}}const{toString:Ne}=Object.prototype,{getPrototypeOf:mt}=Object,{iterator:Z,toStringTag:zt}=Symbol,Q=(t=>e=>{const s=Ne.call(e);return t[s]||(t[s]=s.slice(8,-1).toLowerCase())})(Object.create(null)),A=t=>(t=t.toLowerCase(),e=>Q(e)===t),Y=t=>e=>typeof e===t,{isArray:j}=Array,v=Y(" ...

2`).forEach(function(a){n=a.indexOf(":"),s=a.substring(0,n).trim().toLowerCase(),o=a.substring(n+1).trim(),!(!s||e[s]&&Es[s])&&(s==="set-cookie"?e[s

3`)}getSetCookie(){return this.get("set-cookie")||[]}get[Symbol.toStringTag](){return"AxiosHeaders"}static from(e){return e instanceof this?e:new this(e)}static concat(e,...

4`+a.map(de).join(`

5`):" "+de(a[0]):"as no adapter specified";throw new y("There is no suitable adapter to dispatch the request "+c,"ERR_NOT_SUPPORT")}return n}const he={getAdapter:qs,adapters:Et};function Rt(t){if(t.cancelToken&&t.cancelToken.throwIfRequested(),t.signal&&t.signal.aborted)throw new H(null,t)}function pe(t){return Rt(t),t.headers=x.from(t.headers),t.data=St.call(t,t.transformRequest),["post","put","patch"].indexOf(t.method)!==-1&&t.headers.setContentType("application/x-www-form-urlencoded",!1),he.getAdapter(t.adapter||Ct.adapter,t)(t).then(function(o){return Rt(t),o.data=St.call(t,t.transformRespo ...

6`+r):o.stack=r}catch{}}throw o}}_request(e,s){typeof e=="string"?(s=s||{},s.url=e):s=e||{},s=V(this.defaults,s);const{transitional:o

Long lines were clipped for display.

dist/gsc-strengths.jsView file

Lines 2017-2057javascript

2017 },

2018 provider: {

2019 type: Number,

2020 default: 1

2021 },

2022 isDevApis: {

2023 type: Boolean,

2024 default: !1

Source & flagged code

3 flagged · loading source

dist/gsc-strengths.umd.cjsView file

6patternName = supabase_service_key severity = critical line = 6 matchedText = `+r):o.s...)});

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/gsc-strengths.umd.cjsView on unpkg · L6

6patternName = supabase_service_key severity = critical line = 6 matchedText = `+r):o.s...)});

Critical

Secret Pattern

Supabase service role key (JWT) in dist/gsc-strengths.umd.cjs

dist/gsc-strengths.umd.cjsView on unpkg · L6

dist/gsc-strengths.jsView file

2037patternName = supabase_service_key severity = critical line = 2037 matchedText = token: "...YE",

Critical

Secret Pattern

Supabase service role key (JWT) in dist/gsc-strengths.js

dist/gsc-strengths.jsView on unpkg · L2037

Findings

3 Critical1 Medium4 Low

CriticalCritical Secretdist/gsc-strengths.umd.cjs

CriticalSecret Patterndist/gsc-strengths.umd.cjs

CriticalSecret Patterndist/gsc-strengths.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/gsc-strengths.umd.cjsView file

Lines 1-7javascript

2`).forEach(function(a){n=a.indexOf(":"),s=a.substring(0,n).trim().toLowerCase(),o=a.substring(n+1).trim(),!(!s||e[s]&&Es[s])&&(s==="set-cookie"?e[s

3`)}getSetCookie(){return this.get("set-cookie")||[]}get[Symbol.toStringTag](){return"AxiosHeaders"}static from(e){return e instanceof this?e:new this(e)}static concat(e,...

4`+a.map(de).join(`

6`+r):o.stack=r}catch{}}throw o}}_request(e,s){typeof e=="string"?(s=s||{},s.url=e):s=e||{},s=V(this.defaults,s);const{transitional:o

Long lines were clipped for display.

dist/gsc-strengths.jsView file

Lines 2017-2057javascript

2017 },

2018 provider: {

2019 type: Number,

2020 default: 1

2021 },

2022 isDevApis: {

2023 type: Boolean,

2024 default: !1