registry / @searchos/bot-proxy / 1.4.0

@searchos/bot-proxy@1.4.0

SearchOS 봇 프록시 — Next.js, Cloudflare Worker용 봇 감지 + 캐시 프록시

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Cloudflare runtime route handlers manage the configured KV cache. If EDGE_CACHE_KEY is absent, their authorization guard explicitly fails open.

Static reason

No blocking static signals were detected.

Trigger

A deployed consumer calls cloudflareProxy and receives POST requests to its management paths.

Impact

Attackers may poison, purge, or read cached HTML in an unconfigured deployment.

Mechanism

Unauthenticated Cloudflare KV cache management

Rationale

No malicious package behavior was found, but the shipped Cloudflare proxy intentionally permits unauthenticated cache administration when its secret is omitted. This is a real high-impact unsafe default requiring a warning.

Evidence

package.jsondist/cloudflare.d.tsdist/chunk-MUSFV7JD.jsdist/cloudflare.cjs

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/chunk-MUSFV7JD.js exposes POST cache update, purge, and read routes.
Those routes intentionally bypass authorization when EDGE_CACHE_KEY is unset.

@searchos/bot-proxy@1.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code