registry / Credential exfiltration / @tachybase/module-cloud-component
@tachybase/module-cloud-component
Cloud component
This report shows the evidence for @tachybase/module-cloud-component@1.6.61. 1 of 23 known versions is blocked or flagged. The newest version, 1.6.67, is flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe fetcher forwards configured credentials across redirects without checking whether the destination host changed. Because enabled remote libraries may be fetched after startup, a redirect can disclose those credentials to a host outside the configured source.
Static reason
No blocking static signals were detected.
Trigger
After startup, an enabled remote library without cached code is fetched from its configured URL; a redirect to another host causes the fetcher to resend its configured credentials.
Impact
A redirected-to host can receive the library’s bearer token or Basic Auth credentials.
Mechanism
The redirect handler calls the fetch method with the new URL while preserving the original authentication type, token, and username.
Attack narrative
An enabled remote library can be fetched automatically after startup. If its configured source redirects to another host, the fetcher follows that URL while reusing the original bearer token or Basic Auth credentials, exposing them to the redirect destination.
AI rationale
The fetcher forwards configured credentials across redirects without checking whether the destination host changed. Because enabled remote libraries may be fetched after startup, a redirect can disclose those credentials to a host outside the configured source.
Evidence
dist/server/services/remote-code-fetcher.jsdist/server/services/cloud-libraries-service.js
Network endpoints2
configured codeUrl host (dynamic)HTTP redirect Location host (dynamic)
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The remote-code fetcher puts a configured bearer token in the Authorization header.
- On an HTTP redirect, the fetcher follows the redirect URL and forwards the same authentication credentials.
- When an enabled remote library has no cached code, startup fetches it using its stored authentication settings; the service runs this loading after app startup.
Evidence against
- The package is designed to load cloud libraries from configured remote sources, so remote fetching is part of its stated functionality.
- package.json declares no lifecycle scripts.
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
5 flaggeddist/server/services/cloud-libraries-service.jsView file
47var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
L48: return __privateGet(this, extra);
L49: }, set [name](x) {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/server/services/cloud-libraries-service.jsView on unpkg · L47dist/client/index.jsView file
•path = dist/client/index.js
kind = oversized_source_file
sizeBytes = 8254994
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/client/index.jsView on unpkgdist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
Findings
1 Critical1 High5 Medium5 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
MediumUnsafe Vm Contextdist/server/services/cloud-libraries-service.js
MediumNetwork
MediumOversized Source Filedist/client/index.js
MediumStructural Risk Force Deep Review
MediumStripped Provenance Metadatadist/server/services/remote-code-fetcher.js
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @tachybase/module-cloud-component@1.6.61.
The versions list below shows the verdict for each recorded version.
- Avoid installing @tachybase/module-cloud-component@1.6.61. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.