registry / Credential exfiltration / @retailrocketgroup/retailrocket-edit.product-back-in-stock-vue-email-template-render / 11.0.432996
@retailrocketgroup/retailrocket-edit.product-back-in-stock-vue-email-template-render@11.0.432996
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reset flow sends anti-forgery token values to a hard-coded webhook.site collector, and the bundled HTML preserves that endpoint. Although the flow requires a user action, the unrelated token disclosure is concealed within an ordinary editor action and supports blocking this version.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
The user selects the action that returns to template selection.
Impact
The unrelated collector receives the token, which may expose the host application's authenticated form capability.
Mechanism
The handler puts the anti-forgery form token from page attributes into a POST form whose URL is hard-coded to webhook.site in the package HTML.
Attack narrative
The package’s HTML points the reset form at a unique webhook.site URL. When the user returns to template selection, the handler submits anti-forgery token data read from the page to that collector, exposing a runtime token to an unrelated host.
AI rationale
The reset flow sends anti-forgery token values to a hard-coded webhook.site collector, and the bundled HTML preserves that endpoint. Although the flow requires a user action, the unrelated token disclosure is concealed within an ordinary editor action and supports blocking this version.
Evidence
index.htmldist/index.htmlsrc/editProductBackInStockEmailTemplate.ts
Network endpoints1
webhook.site
Decision evidence
public snapshotAI called this Malicious at 92.0% confidence as Malware with low false-positive risk.
Evidence for block
- The reset handler adds the anti-forgery form token name and value to a POST form, then submits it to the page-provided reset URL.
- Both the source HTML and built HTML set that reset URL to https://webhook.site/a85a171c-bb86-4693-9552-d209a59a7e6a.
- The source reads the anti-forgery token and reset URL from page attributes, so the handler can send runtime values.
- The reset handler is called by the template-selection return callback.
Evidence against
- The package manifest contains no lifecycle scripts.
- The form submission is triggered by the template-selection return callback rather than during package installation or import.
Behavioral surface
Network
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
6 flaggeddist/assets/index.jsView file
•matchType = malicious_source_fingerprint_signature
signature = a49f8411e2470f3f
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @retailrocketgroup/retailrocket-edit.abandoned-view-vue-email-template-render@11.0.433123
matchedPath = dist/assets/index.js
matchedIdentity = npm:[redacted]:11.0.433123
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/assets/index.jsView on unpkg•path = dist/assets/index.js
kind = oversized_source_file
sizeBytes = 8323492
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/assets/index.jsView on unpkgsrc/editProductBackInStockEmailTemplate.ts
Findings
5 High3 Medium4 Low
HighKnown Malware Source Fingerprint Signaturedist/assets/index.js
HighAi Review Evidencesrc/editProductBackInStockEmailTemplate.ts
HighAi Review Evidenceindex.html
HighAi Review Evidencesrc/editProductBackInStockEmailTemplate.ts
HighAi Review Evidencesrc/editProductBackInStockEmailTemplate.ts
MediumNetwork
MediumOversized Source Filedist/assets/index.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @retailrocketgroup/retailrocket-edit.product-back-in-stock-vue-email-template-render@11.0.432996.
See all versions of @retailrocketgroup/retailrocket-edit.product-back-in-stock-vue-email-template-render for other recorded verdicts.
- Avoid installing @retailrocketgroup/retailrocket-edit.product-back-in-stock-vue-email-template-render@11.0.432996. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.