@tachybase/module-cloud-component@1.6.49
Cloud component
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package’s remote-code feature is consistent with its purpose, and remote libraries are disabled by default. However, its CDN redirect handling forwards configured credentials to a potentially different host, a real credential-disclosure risk that merits a warning.
Static reason
No blocking static signals were detected.
Trigger
At startup, an enabled server library with a remote CDN source, authentication credentials, and no cached code is fetched; an explicit remote-code sync can also fetch configured sources.
Impact
A redirecting code host can cause the configured token or basic-auth credentials to be sent to another host.
Mechanism
The fetcher follows redirect locations and recursively calls itself with the original authentication type, token, and username, without checking whether the redirect changes hosts.
AI rationale
The package’s remote-code feature is consistent with its purpose, and remote libraries are disabled by default. However, its CDN redirect handling forwards configured credentials to a potentially different host, a real credential-disclosure risk that merits a warning.
Evidence
dist/server/services/cloud-libraries-service.jsdist/server/services/remote-code-fetcher.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- At startup, the service loads enabled server-side cloud libraries and fetches uncached remote code using the library’s configured authentication.
- The CDN fetcher adds configured bearer or basic credentials to the request and passes those same credentials when following a redirect.
- The package describes itself as a cloud component module, and its library service supports fetching configured remote code.
Evidence against
- Cloud libraries default to disabled, so this behavior requires an enabled library configuration.
- No hard-coded external destination or install lifecycle script was identified; the code URL and credentials come from the library configuration.
Behavioral surface
Network
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/server/services/cloud-libraries-service.jsView file
47var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
L48: return __privateGet(this, extra);
L49: }, set [name](x) {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/server/services/cloud-libraries-service.jsView on unpkg · L47200async loadServerLibraries() {
this.logger.info(`load cloudLibrarie: start`);
const repo = this.app.db.getRepository("effectLibraries");
const cloudLibraries = await repo.find({
filter: {
enabled: true,
isServer: true
}
Medium
Ai Review Evidence
At startup, the service loads enabled server-side cloud libraries and fetches uncached remote code using the library’s configured authentication.
dist/server/services/cloud-libraries-service.jsView on unpkg · L200313async load() {
this.app.acl.allow("effectLibraries", "list", "public");
this.app.on("afterStart", async () => {
await this.compileLibraries();
await this.loadServerLibraries();
});
Findings
1 Critical1 High6 Medium4 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
MediumUnsafe Vm Contextdist/server/services/cloud-libraries-service.js
MediumNetwork
MediumOversized Source Filedist/client/index.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/server/services/cloud-libraries-service.js
MediumAi Review Evidencedist/server/services/cloud-libraries-service.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @tachybase/module-cloud-component@1.6.49.
See all versions of @tachybase/module-cloud-component for other recorded verdicts.
- Review the evidence and your use of @tachybase/module-cloud-component@1.6.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.