@tachybase/module-cloud-component@1.6.51
Cloud component
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package has no install hook, and remote fetching is a core feature, but its redirect handling forwards configured credentials without a host check. This is a credential-disclosure vulnerability requiring an enabled remote library and a redirecting source, so it warrants a warning rather than a malicious-package block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An enabled remote library is fetched at startup with authentication configured, and its source host responds with a redirect to another host.
Impact
The redirect destination may receive credentials intended for the configured source host.
Mechanism
The fetcher follows redirects recursively while reusing the original authentication settings, including the Authorization header.
AI rationale
The package has no install hook, and remote fetching is a core feature, but its redirect handling forwards configured credentials without a host check. This is a credential-disclosure vulnerability requiring an enabled remote library and a redirecting source, so it warrants a warning rather than a malicious-package block.
Evidence
dist/server/services/remote-code-fetcher.jsdist/server/services/cloud-libraries-service.js
Network endpoints1
Configured remote code URL and redirect destination; GitHub raw URL construction is also present in dist/server/services/remote-code-fetcher.js.
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The configured remote-library fetch passes the library's codeAuthToken and related authentication settings into fetchCode.
- Bearer authentication is placed in the Authorization header for remote fetches.
- When a response redirects, fetchFromCDN recursively requests the redirect URL with the same authType, authToken, and authUsername; it does not restrict the redirect to the original host.
- At application startup, enabled libraries are compiled and server libraries are loaded automatically.
Evidence against
- The manifest has no lifecycle scripts and declares the server entry point as dist/server/index.js.
- Remote fetching is part of the package's cloud-library feature and is gated on a library being configured with codeSource set to remote, a URL, and a code type.
- The automatic startup path uses cached code when available and fetches remote code only when the cache is absent.
Behavioral surface
ChildProcessNetwork
HighEntropyStrings
Source & flagged code
6 flaggeddist/server/services/cloud-libraries-service.jsView file
47var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
L48: return __privateGet(this, extra);
L49: }, set [name](x) {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/server/services/cloud-libraries-service.jsView on unpkg · L47134this.logger.info(
`[${module2}] Auth config: type=${codeAuthType || "none"}, hasToken=${!!codeAuthToken}, hasUsername=${!!codeAuthUsername}`
);
code = await this.remoteCodeFetcher.fetchCode(
codeUrl,
codeType,
codeBranch,
co
Medium
Ai Review Evidence
The configured remote-library fetch passes the library's codeAuthToken and related authentication settings into fetchCode.
dist/server/services/cloud-libraries-service.jsView on unpkg · L134dist/client/index.jsView file
Findings
1 Critical2 High5 Medium4 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/node_modules/@babel/preset-env/lib/index.js
MediumUnsafe Vm Contextdist/server/services/cloud-libraries-service.js
MediumNetwork
MediumOversized Source Filedist/client/index.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/server/services/cloud-libraries-service.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @tachybase/module-cloud-component@1.6.51.
See all versions of @tachybase/module-cloud-component for other recorded verdicts.
- Review the evidence and your use of @tachybase/module-cloud-component@1.6.51 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.