@retailrocketgroup
LPM Firewall blocks 9 packages in the @retailrocketgroup npm scope. 9 have LPM's own review and are listed first.
The package configures a webhook.site destination for a form that submits the anti-forgery token. This is credential exfiltration triggered by an ordinary editor action, so the release sh...
The shipped page config directs a form containing the application’s anti-forgery token to an unrelated webhook collector when the reset action runs. This is credential disclosure to a for...
The shipped reset flow sends a Retail Rocket anti-forgery token to a hard-coded webhook.site collector. This is credential exfiltration even though it is triggered by a UI action.
The reset action sends an anti-forgery token to a hard-coded webhook.site endpoint in the shipped HTML. Although the POST requires the user to invoke the reset flow, that action does not...
The reset flow directs an anti-forgery token to a hardcoded unrelated webhook collector, which is not needed for the editor’s stated function. The shipped HTML currently contains a placeh...
The reset flow submits an anti-forgery token to a hard-coded webhook.site collector when its return-to-selection callback runs. That is credential exfiltration to an unrelated host.
The reset flow submits an anti-forgery token to a hard-coded external webhook collector. That unrelated token disclosure is concrete data exfiltration.
The reset flow posts an anti-forgery token to a webhook.site collector unrelated to the editor's normal backend. The callback is reached through the editor's return-to-template-selection...
The shipped page routes an application anti-forgery token to a hard-coded unrelated webhook collector through the reset flow. This is concrete credential exfiltration behavior.