@tachybase/module-cloud-component@1.6.57
Cloud component
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package’s remote library feature has a credential-forwarding flaw: redirects reuse the original authentication credentials without checking the destination host. This is a security risk when the configured source redirects elsewhere, but the inspected code does not establish deliberate credential theft.
Static reason
No blocking static signals were detected.
Trigger
Application startup when an enabled remote library has no cached code and its source responds with a redirect.
Impact
A redirect to an unrelated host can receive the library's configured bearer token or basic-auth credentials.
Mechanism
The redirect handler recursively fetches the new URL while reusing the original authentication type, token, and username.
AI rationale
The package’s remote library feature has a credential-forwarding flaw: redirects reuse the original authentication credentials without checking the destination host. This is a security risk when the configured source redirects elsewhere, but the inspected code does not establish deliberate credential theft.
Evidence
dist/server/services/remote-code-fetcher.jsdist/server/services/cloud-libraries-service.jsCloud library codeCache database record
Network endpoints1
HTTP/HTTPS host from the configured codeUrl and any redirect Location
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- Remote library fetching passes its configured authentication type, token, and username to the fetcher.
- When a fetch receives a redirect, it follows the destination while passing the same authentication credentials again.
- After application startup, the service compiles enabled libraries, which can trigger remote fetching.
Evidence against
- The manifest has no install lifecycle scripts.
- The package is a cloud component plugin with a remote library fetching feature.
Behavioral surface
Network
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
dist/client/index.js7.87 MB file, sampled 256 KB
Source & flagged code
6 flaggeddist/server/services/cloud-libraries-service.jsView file
47var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
L48: return __privateGet(this, extra);
L49: }, set [name](x) {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/server/services/cloud-libraries-service.jsView on unpkg · L47137code = await this.remoteCodeFetcher.fetchCode(
codeUrl,
codeType,
codeBranch,
codePath,
codeAuthType,
Medium
Ai Review Evidence
Remote library fetching passes its configured authentication type, token, and username to the fetcher.
dist/server/services/cloud-libraries-service.jsView on unpkg · L137dist/client/index.jsView file
Findings
1 Critical1 High6 Medium4 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
MediumUnsafe Vm Contextdist/server/services/cloud-libraries-service.js
MediumNetwork
MediumOversized Source Filedist/client/index.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/server/services/remote-code-fetcher.js
MediumAi Review Evidencedist/server/services/cloud-libraries-service.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @tachybase/module-cloud-component@1.6.57.
See all versions of @tachybase/module-cloud-component for other recorded verdicts.
- Review the evidence and your use of @tachybase/module-cloud-component@1.6.57 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.