@tachybase/module-cloud-component@1.6.67
Cloud component
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package is not clearly malicious, but its remote-code fetcher forwards configured authentication credentials across redirects without validating the destination host. This is a concrete credential-handling risk, although it requires a remote library configuration and a redirect response.
Static reason
No blocking static signals were detected.
Trigger
The application starts with an enabled cloud library configured for remote fetching, and its URL responds with a redirect.
Impact
A redirect controlled by or routed through the configured remote source could disclose the library’s configured credential to another host.
Mechanism
The fetcher reuses the original authentication type, token, and username when it requests the redirect destination without checking the destination host.
AI rationale
The package is not clearly malicious, but its remote-code fetcher forwards configured authentication credentials across redirects without validating the destination host. This is a concrete credential-handling risk, although it requires a remote library configuration and a redirect response.
Evidence
dist/server/services/remote-code-fetcher.jsdist/server/services/cloud-libraries-service.js
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The fetcher adds a configured bearer token to the Authorization header.
- On an HTTP redirect, the fetcher follows the redirect by calling itself with the same authentication arguments; it does not check that the destination host matches the configured URL.
- The remote fetch path is used only for cloud libraries configured with a remote source and URL.
- The manifest has no install lifecycle scripts and declares no runtime dependencies.
Evidence against
- The package’s remote-code feature is explicitly configured with a source URL and authentication settings.
- The VM execution occurs in the cloud-library loading feature, which runs after the application starts and handles enabled libraries.
- No hard-coded external collector or unrelated destination was identified.
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/server/services/cloud-libraries-service.jsView file
47var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
L48: return __privateGet(this, extra);
L49: }, set [name](x) {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/server/services/cloud-libraries-service.jsView on unpkg · L47dist/client/index.jsView file
•path = dist/client/index.js
kind = oversized_source_file
sizeBytes = 8254994
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/client/index.jsView on unpkgdist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
Findings
1 Critical1 High5 Medium5 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/node_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
MediumUnsafe Vm Contextdist/server/services/cloud-libraries-service.js
MediumNetwork
MediumOversized Source Filedist/client/index.js
MediumStructural Risk Force Deep Review
MediumStripped Provenance Metadatadist/server/services/remote-code-fetcher.js
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @tachybase/module-cloud-component@1.6.67.
See all versions of @tachybase/module-cloud-component for other recorded verdicts.
- Review the evidence and your use of @tachybase/module-cloud-component@1.6.67 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.