registry / Credential exfiltration / @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render / 11.0.433123
@retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render@11.0.433123
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe packaged UI directs a reset POST containing an anti-forgery token to webhook.site, an unrelated collection endpoint. Although the POST requires a user action, that action does not reasonably authorize sending the token to the hardcoded collector.
Static reason
No blocking static signals were detected.
Trigger
A user selects the app's return-to-template-selection action.
Impact
The collector receives the anti-forgery token, which could enable unauthorized requests in the relevant application context.
Mechanism
The reset handler constructs a POST form containing the anti-forgery form token and submits it to the reset URL, which the packaged HTML hardcodes to webhook.site.
Attack narrative
The packaged HTML configures template reset to a webhook.site URL. When the user chooses to return to template selection, the app submits the anti-forgery form token to that collector, exposing a security token to an unrelated host.
AI rationale
The packaged UI directs a reset POST containing an anti-forgery token to webhook.site, an unrelated collection endpoint. Although the POST requires a user action, that action does not reasonably authorize sending the token to the hardcoded collector.
Evidence
dist/index.htmlsrc/editAbandonedViewEmailTemplate.ts
Network endpoints1
webhook.site/a85a171c-bb86-4693-9552-d209a59a7e6a
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The packaged HTML sets the reset form URL to https://webhook.site/a85a171c-bb86-4693-9552-d209a59a7e6a.
- The reset handler POSTs the anti-forgery form token to the URL supplied by the HTML.
- The app invokes that handler when the user selects return to template selection.
Evidence against
- The package is an email template editor and sends save requests through a RetailRocket backend client.
- The suspicious POST occurs on a return action rather than automatically at import.
Behavioral surface
Network
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
dist/assets/index.js7.94 MB file, sampled 256 KB
Source & flagged code
4 flaggeddist/assets/index.jsView file
•path = dist/assets/index.js
kind = oversized_source_file
sizeBytes = 8323034
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/assets/index.jsView on unpkgdist/index.htmlView file
30data-reset-template-form-url="https://webhook.site/a85a171c-bb86-4693-9552-d209a59a7e6a"
data-exit-link="ya.ru"
data
High
Ai Review Evidence
The packaged HTML sets the reset form URL to https://webhook.site/a85a171c-bb86-4693-9552-d209a59a7e6a.
dist/index.htmlView on unpkg · L30src/editAbandonedViewEmailTemplate.ts
Findings
3 High3 Medium4 Low
HighAi Review Evidencedist/index.html
HighAi Review Evidencesrc/editAbandonedViewEmailTemplate.ts
HighAi Review Evidencesrc/editAbandonedViewEmailTemplate.ts
MediumNetwork
MediumOversized Source Filedist/assets/index.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render@11.0.433123.
See all versions of @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render for other recorded verdicts.
- Avoid installing @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render@11.0.433123. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.