@hymbz/comic-read-script@12.14.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@hymbz/comic-read-script@12.14.0: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

ComicReader.umd.jsView file

5"helper/languages": "\n//#region src/helper/languages.ts\nconst langList = [\n \"zh\",\n \"en\",\n \"ru\"\n];\n/** 判断传入的字符串是否是支持的语言类型代码 */\nconst isLanguages = (lang) => Boolean(la... L6: helper: "\nlet helper_languages = require(\"helper/languages\");\nlet solid_js = require(\"solid-js\");\nlet solid_js_web = require(\"solid-js/web\");\nlet solid_js_store = require... L7: request: "\nlet components_Toast = require(\"components/Toast\");\nlet helper = require(\"helper\");\n//#region src/request.ts\nconst xmlHttpRequest = (details) => new Promise((res...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

ComicReader.umd.jsView on unpkg · L5

ComicRead-AdGuard.user.jsView file

•Browser cookie sent to a fixed external endpoint in ComicRead-AdGuard.user.js: // @resource solid-js https://cdn.jsdelivr.net/npm/solid-js@1.9.8/dist/solid.cjs // @resource fflate https://cdn.jsdelivr.net/npm/fflate@0.8.2/umd/index.js // @resource jsqr https://cdn.jsdelivr.net/npm/jsqr@1.4.0/dist/jsQR.js // @resource comlink https://cdn.jsdelivr.net/npm/comlink@4.4.2/dist/umd/comlink.min.js // @resource solid-js|store https://cdn.jsdelivr.net/npm/solid-js@1.9.8/store/dist/store.cjs // @resource solid-js|web https://cdn.jsdelivr.net/npm/solid-js@1.9.8/web/dist/web.cjs // @resource _tensorflow|tfjs https://cdn.jsdelivr.net/npm/@tensorflow/tfjs@4.22.0/dist/tf.min.js // @resource _tensorflow|tfjs-backend-webgpu https://cdn.jsdelivr.net/np

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

ComicRead-AdGuard.user.jsView on unpkg

19// @match *://mangacopy.com/* // @match *://www.mangacopy.com/*

High

Ai Review Evidence

The userscript runs automatically on MangaCopy pages.

ComicRead-AdGuard.user.jsView on unpkg · L19

100// @connect 127.0.0.1 // @connect * // @connect mapi.hotmangasg.com // @connect api.2024manga.com // @connect m.manga2025.com // @connect api.manga2025.com // @connect mapi.fgjfghkk.club // @connect mapi.fgjfghkkcenter.club // @connect mapi.elfgjfghkk.club // @connect mapi.hotmangasd.com // @connect mapi.hotmangasf.com // @connect www.manga2026.xyz // @connect www.manga2025.com // @connect mapi.copy20.com // @connect api.2026copy.com // @connect api.copy4000.com // @

High

Ai Review Evidence

It sends that credential-bearing header to many alternate, unrelated hosts and has unrestricted cross-origin request permission.

ComicRead-AdGuard.user.jsView on unpkg · L100

10245eachGet = (url, details) => request.eachApi(url, [ "https://mapi.hotmangasg.com", "https://api.2024manga.com", "https://m.manga2025.com", "https://api.manga2025.com", "https://mapi.fgjfghkk.club", "https://mapi.fgjfghkkcenter.club", "https://mapi.elfgjfghkk.club", "https://mapi.hotmangasd.com", "https://mapi.hotmangasf.com", "https://www.manga2026.xyz", "https://www.manga2025.com" ], { responseType: "json", headers: this.headers, fetch: false,

High

Ai Review Evidence

It sends that credential-bearing header to many alternate, unrelated hosts and has unrestricted cross-origin request permission.

ComicRead-AdGuard.user.jsView on unpkg · L10245

10196const token = document.cookie.split("; ").find((cookie) => cookie.startsWith("token="))?.replace("token=", ""); const mobileApi = new class { headers = { webp: "1", region: "1", "User-Agent": "COPY/3.0.0", version: "3.0.9", source: "copyApp", referer: "com.copymanga.app-3.0.0", Authorization: token ? \`Token \${token}\` : ""

Medium

Stripped Provenance Metadata

It reads the site's token cookie and uses it as an Authorization credential.

ComicRead-AdGuard.user.jsView on unpkg · L10196

Source & flagged code

6 flagged

ComicReader.umd.jsView file

5"helper/languages": "\n//#region src/helper/languages.ts\nconst langList = [\n \"zh\",\n \"en\",\n \"ru\"\n];\n/** 判断传入的字符串是否是支持的语言类型代码 */\nconst isLanguages = (lang) => Boolean(la... L6: helper: "\nlet helper_languages = require(\"helper/languages\");\nlet solid_js = require(\"solid-js\");\nlet solid_js_web = require(\"solid-js/web\");\nlet solid_js_store = require... L7: request: "\nlet components_Toast = require(\"components/Toast\");\nlet helper = require(\"helper\");\n//#region src/request.ts\nconst xmlHttpRequest = (details) => new Promise((res...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

ComicReader.umd.jsView on unpkg · L5

ComicRead-AdGuard.user.jsView file

•Browser cookie sent to a fixed external endpoint in ComicRead-AdGuard.user.js: // @resource solid-js https://cdn.jsdelivr.net/npm/solid-js@1.9.8/dist/solid.cjs // @resource fflate https://cdn.jsdelivr.net/npm/fflate@0.8.2/umd/index.js // @resource jsqr https://cdn.jsdelivr.net/npm/jsqr@1.4.0/dist/jsQR.js // @resource comlink https://cdn.jsdelivr.net/npm/comlink@4.4.2/dist/umd/comlink.min.js // @resource solid-js|store https://cdn.jsdelivr.net/npm/solid-js@1.9.8/store/dist/store.cjs // @resource solid-js|web https://cdn.jsdelivr.net/npm/solid-js@1.9.8/web/dist/web.cjs // @resource _tensorflow|tfjs https://cdn.jsdelivr.net/npm/@tensorflow/tfjs@4.22.0/dist/tf.min.js // @resource _tensorflow|tfjs-backend-webgpu https://cdn.jsdelivr.net/np

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

ComicRead-AdGuard.user.jsView on unpkg

19// @match *://mangacopy.com/* // @match *://www.mangacopy.com/*

High

Ai Review Evidence

The userscript runs automatically on MangaCopy pages.

ComicRead-AdGuard.user.jsView on unpkg · L19

100// @connect 127.0.0.1 // @connect * // @connect mapi.hotmangasg.com // @connect api.2024manga.com // @connect m.manga2025.com // @connect api.manga2025.com // @connect mapi.fgjfghkk.club // @connect mapi.fgjfghkkcenter.club // @connect mapi.elfgjfghkk.club // @connect mapi.hotmangasd.com // @connect mapi.hotmangasf.com // @connect www.manga2026.xyz // @connect www.manga2025.com // @connect mapi.copy20.com // @connect api.2026copy.com // @connect api.copy4000.com // @

High

Ai Review Evidence

It sends that credential-bearing header to many alternate, unrelated hosts and has unrestricted cross-origin request permission.

ComicRead-AdGuard.user.jsView on unpkg · L100

10245eachGet = (url, details) => request.eachApi(url, [ "https://mapi.hotmangasg.com", "https://api.2024manga.com", "https://m.manga2025.com", "https://api.manga2025.com", "https://mapi.fgjfghkk.club", "https://mapi.fgjfghkkcenter.club", "https://mapi.elfgjfghkk.club", "https://mapi.hotmangasd.com", "https://mapi.hotmangasf.com", "https://www.manga2026.xyz", "https://www.manga2025.com" ], { responseType: "json", headers: this.headers, fetch: false,

High

Ai Review Evidence

It sends that credential-bearing header to many alternate, unrelated hosts and has unrestricted cross-origin request permission.

ComicRead-AdGuard.user.jsView on unpkg · L10245

10196const token = document.cookie.split("; ").find((cookie) => cookie.startsWith("token="))?.replace("token=", ""); const mobileApi = new class { headers = { webp: "1", region: "1", "User-Agent": "COPY/3.0.0", version: "3.0.9", source: "copyApp", referer: "com.copymanga.app-3.0.0", Authorization: token ? \`Token \${token}\` : ""

Medium

Stripped Provenance Metadata

It reads the site's token cookie and uses it as an Authorization credential.

ComicRead-AdGuard.user.jsView on unpkg · L10196