registry / Credential exfiltration / @retailrocketgroup/retailrocket-edit.post-transaction-vue-email-template-render
@retailrocketgroup/retailrocket-edit.post-transaction-vue-email-template-render
This report shows the evidence for @retailrocketgroup/retailrocket-edit.post-transaction-vue-email-template-render@11.0.433449. 1 of 12 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe reset action sends an anti-forgery token to a hard-coded webhook.site endpoint in the shipped HTML. Although the POST requires the user to invoke the reset flow, that action does not reasonably authorize disclosing the token to an unrelated collector.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A user activates the template-selection reset flow.
Impact
The collector receives the anti-forgery token, which may enable unauthorized requests within the affected application context.
Mechanism
The app builds a POST form containing the anti-forgery token and submits it to the reset URL hard-coded in the shipped HTML.
Attack narrative
When the user invokes the template-selection reset callback, the app submits a form containing its anti-forgery token. The shipped HTML directs that POST to a webhook.site URL, an unrelated collection endpoint, exposing the token.
AI rationale
The reset action sends an anti-forgery token to a hard-coded webhook.site endpoint in the shipped HTML. Although the POST requires the user to invoke the reset flow, that action does not reasonably authorize disclosing the token to an unrelated collector.
Evidence
src/editPostTransactionEmailTemplate.tsdist/index.html
Network endpoints1
webhook.site
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The reset flow places the anti-forgery form token name and value into form data.
- The reset form POSTs to a URL supplied by resetTemplateFormUrl.
- The shipped dist/index.html sets resetTemplateFormUrl to https://webhook.site/a85a171c-bb86-4693-9552-d209a59a7e6a.
- The reset flow is invoked by the onReturnToTemplateSelection callback.
Evidence against
- The manifest declares no lifecycle scripts or package entry points.
- The token submission occurs when the template-selection reset callback runs, rather than on import.
Behavioral surface
Network
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
dist/assets/index.js7.94 MB file, sampled 256 KB
Source & flagged code
6 flaggeddist/assets/index.jsView file
•matchType = malicious_source_fingerprint_signature
signature = a49f8411e2470f3f
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @retailrocketgroup/retailrocket-edit.abandoned-view-price-drop-vue-email-template-render@11.0.433449
matchedPath = dist/assets/index.js
matchedIdentity = npm:[redacted]:11.0.433449
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/assets/index.jsView on unpkg•path = dist/assets/index.js
kind = oversized_source_file
sizeBytes = 8325260
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/assets/index.jsView on unpkgsrc/editPostTransactionEmailTemplate.ts
Findings
5 High3 Medium4 Low
HighKnown Malware Source Fingerprint Signaturedist/assets/index.js
HighAi Review Evidencesrc/editPostTransactionEmailTemplate.ts
HighAi Review Evidencesrc/editPostTransactionEmailTemplate.ts
HighAi Review Evidencedist/index.html
HighAi Review Evidencesrc/editPostTransactionEmailTemplate.ts
MediumNetwork
MediumOversized Source Filedist/assets/index.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @retailrocketgroup/retailrocket-edit.post-transaction-vue-email-template-render@11.0.433449.
The versions list below shows the verdict for each recorded version.
- Avoid installing @retailrocketgroup/retailrocket-edit.post-transaction-vue-email-template-render@11.0.433449. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.