@slowcook-ai/review-overlay@0.25.7
Floating review overlay for slowcook mock previews — element-anchored comments, screenshot, viewport metadata; submits to the mockup PR via PAT. Mounted into the mock app's root layout. Plate parses the comments back out for amendments.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe component silently sends a stored GitHub credential to the screen-time relay, which defaults to authBase, despite the README promising the PAT only goes to GitHub. The Trojan Source alert on comment-format.js was not confirmed as attack behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Automatic during active review-time reporting and after a successful issue filing when a relay is configured and a token is stored.
Impact
The relay operator can receive and potentially use the user's GitHub credential. This contradicts the README's claim that the PAT only goes to GitHub.
Mechanism
The relay defaults to authBase; report requests POST to its /screentime path with the GitHub token in a Bearer authorization header.
Attack narrative
When a relay is configured, the React component defaults its screen-time destination to authBase and automatically posts review reports there with the stored GitHub token as a Bearer credential. This occurs during active review-time reporting and after an issue is filed. The README says the PAT only leaves the browser on direct requests to GitHub, so users are not told that this credential is forwarded to the relay.
AI rationale
The component silently sends a stored GitHub credential to the screen-time relay, which defaults to authBase, despite the README promising the PAT only goes to GitHub. The Trojan Source alert on comment-format.js was not confirmed as attack behavior.
Evidence
dist/react/github-issue-review.jsREADME.mdlocalStorage key slowcook.review-overlay.reviewer-token.{owner}/{repo}
Network endpoints2
api.github.com${screentimeBase}/screentime (screentimeBase defaults to authBase)
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The screen-time relay defaults to the configured authBase.
- The relay receives the stored GitHub token in a Bearer header on a POST to /screentime.
- The component sends relay reports automatically during active review time and after successful issue filing.
- The README says the PAT only leaves the browser on direct fetches to GitHub's API.
Evidence against
- The package is designed to file review comments as GitHub issues, and its GitHub API requests send tokens to api.github.com.
- The relay host is configurable rather than a hard-coded collector.
- The package declares no install lifecycle scripts.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/comment-format.jsView file
242contains invisible/control Unicode U+2066 (left-to-right isolate)
* financial widget a concatenated run-on ("Available to withdraw<U+2066>150 USDT<U+2069>…")
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/comment-format.jsView on unpkg · L242•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/comment-format.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/comment-format.jsView on unpkgdist/react/github-issue-review.js#virtual:normalized:round1View file
Findings
3 Critical3 High3 Medium3 Low
CriticalTrojan Source Unicodedist/comment-format.js
CriticalTrigger Reachable Dangerous Capabilitydist/comment-format.js
CriticalPrevious Version Dangerous Deltadist/react/github-issue-review.js
HighSemantic Analysis Limiteddist/react/github-issue-review.js#virtual:normalized:round1
HighAi Review Evidencedist/react/github-issue-review.js
HighAi Review Evidencedist/react/github-issue-review.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @slowcook-ai/review-overlay@0.25.7.
See all versions of @slowcook-ai/review-overlay for other recorded verdicts.
- Avoid installing @slowcook-ai/review-overlay@0.25.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.