registry / Credential exfiltration / @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render / 11.0.432996
@retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render@11.0.432996
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe bundled reset URL points to webhook.site, and the reset flow sends the anti-forgery form token to that configured destination. This is credential exfiltration, even though the flow requires the user to select the return action.
Static reason
No blocking static signals were detected.
Trigger
The user returns to template selection in the bundled application.
Impact
The unrelated collector receives a token intended to protect the host application's forms.
Mechanism
A form POST sends the anti-forgery form token name and value to the reset URL, which the bundled HTML sets to webhook.site.
Attack narrative
The bundled page configures its reset form to a webhook.site URL. When the user returns to template selection, the application POSTs the anti-forgery form token to that URL, disclosing a credential to an unrelated collector.
AI rationale
The bundled reset URL points to webhook.site, and the reset flow sends the anti-forgery form token to that configured destination. This is credential exfiltration, even though the flow requires the user to select the return action.
Evidence
dist/index.htmlsrc/editAbandonedViewEmailTemplate.ts
Network endpoints1
webhook.site/a85a171c-bb86-4693-9552-d209a59a7e6a
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The built HTML sets the reset form URL to a specific webhook.site endpoint.
- The reset handler POSTs the anti-forgery form token name and value to the configured reset URL.
- The handler is called when the user returns to template selection.
Evidence against
- The manifest declares no lifecycle scripts or executable entry points.
- The token POST is triggered by a user action rather than on import or startup.
- The template save request uses a configured editor BFF base URL.
Behavioral surface
Network
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
dist/assets/index.js7.94 MB file, sampled 256 KB
Source & flagged code
4 flaggeddist/assets/index.jsView file
•path = dist/assets/index.js
kind = oversized_source_file
sizeBytes = 8323013
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/assets/index.jsView on unpkgdist/index.htmlView file
30data-reset-template-form-url="https://webhook.site/a85a171c-bb86-4693-9552-d209a59a7e6a"
data-exit-link="ya.ru"
data-locale-key="en"
></div>
</body>
</htm
High
Ai Review Evidence
The built HTML sets the reset form URL to a specific webhook.site endpoint.
dist/index.htmlView on unpkg · L30src/editAbandonedViewEmailTemplate.ts
Findings
3 High3 Medium4 Low
HighAi Review Evidencedist/index.html
HighAi Review Evidencesrc/editAbandonedViewEmailTemplate.ts
HighAi Review Evidencesrc/editAbandonedViewEmailTemplate.ts
MediumNetwork
MediumOversized Source Filedist/assets/index.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render@11.0.432996.
See all versions of @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render for other recorded verdicts.
- Avoid installing @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render@11.0.432996. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.