registry / Data exfiltration / @pisell/private-materials
@pisell/private-materials
pisell前端使用的私有物料
This report shows the evidence for @pisell/private-materials@3.4.136. 1 of 334 known versions is blocked or flagged. The newest version, 1.1.2413, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms concrete payment-related data exfiltration to hardcoded external webhook credentials. Lack of lifecycle hooks does not mitigate the runtime disclosure path.
Static reason
No blocking static signals were detected.
Trigger
Consumer renders or uses payment/EFTPOS components, including payment initialization or error handling.
Impact
Payment-group data, order/device identifiers, transaction logs, and error stacks may be disclosed to webhook recipients.
Mechanism
Hardcoded webhook POSTs through sendWarningLog
Attack narrative
The bundled low-code runtime defines sendWarningLog with embedded Feishu webhook URLs and POSTs supplied title/content. Payment components invoke it on initialization and failures, including serialized payGroup data, transaction/order/device identifiers, payment logs, and error stacks. These runtime disclosures occur without a consumer-configured telemetry endpoint or consent mechanism.
AI rationale
Source inspection confirms concrete payment-related data exfiltration to hardcoded external webhook credentials. Lack of lifecycle hooks does not mitigate the runtime disclosure path.
Evidence
package.jsonbuild/lowcode/view.jslib/components/pay/toC/PaymentMethods/index.jslib/components/eftposPay/utils/payLog.jses/hooks/usePaymentLogger.js
Network endpoints2
open.feishu.cn/open-apis/bot/v2/hook/985186a7-d939-4daf-9f30-3a3cc9c47d97open.feishu.cn/open-apis/bot/v2/hook/887dfff9-2ccc-4513-87ff-a05d8cef953e
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- build/lowcode/view.js hardcodes two Feishu bot webhooks and POSTs JSON to one.
- lib/components/pay/toC/PaymentMethods/index.js sends full serialized payGroup to sendWarningLog during payment initialization.
- lib/components/eftposPay/utils/payLog.js uploads transaction, order, device, and payment log data.
- es/hooks/usePaymentLogger.js uploads payment errors and stack traces via sendWarningLog.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- No native binaries or install-time execution were found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcebuild/lowcode/preview.jsView file
20* Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
L21: */(function(){var i,a="4.17.21",s=200,u="Unsupported core-js use. Try https://npms.io/search?q=ponyfill.",l="Expected a function",c="Invalid `variable` option passed into `_.templa...
L22: /** @license React v16.13.1
Low
Eval
Package source references a known benign dynamic code generation pattern.
build/lowcode/preview.jsView on unpkg · L20build/lowcode/render/default/view.jsView file
•path = [redacted].js
kind = oversized_source_file
sizeBytes = 12550238
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
build/lowcode/render/default/view.jsView on unpkglowcode/login2/TEST_CONFIG.mdView file
Findings
1 High5 Medium5 Low
HighOversized Source Filebuild/lowcode/render/default/view.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternlowcode/login2/TEST_CONFIG.md
MediumSecret Patternlowcode/login2/CONFIG.md
LowScripts Present
LowEvalbuild/lowcode/preview.js
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @pisell/private-materials@3.4.136.
The versions list below shows the verdict for each recorded version.
- Avoid installing @pisell/private-materials@3.4.136. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.