registry / @vbansal67/npm-is-so-so-tuff / 1.0.0

@vbansal67/npm-is-so-so-tuff@1.0.0

Web

AI Security Review

scanned 25d ago · by lpm-firewall-ai

A browser UI collects an npm token and a selected package file. In normal web use, it sends both to a non-npm worker host.

Static reason

No blocking static signals were detected.

Trigger

A user opens index.html, selects a file, and clicks Publish Link.

Impact

The worker can receive npm credentials and private package source, enabling account or package compromise.

Mechanism

Bearer-token and package-upload relay to a third-party worker.

Attack narrative

The HTML entry point loads a publishing interface. After a user supplies an npm token and package file, app.js serializes the selected content and sends it with the bearer token. Browser execution routes this request to an opaque worker host rather than directly to npm, exposing the credential and package data to that host.

AI rationale

This is concrete credential and source-data exfiltration through an opaque third-party relay. User interaction does not make forwarding an npm bearer token to that host safe.

Evidence

app.jsindex.html

Network endpoints2

dawn-salad-6ee1.vihaanb0715.workers.devregistry.npmjs.org

Decision evidence

public snapshot

AI called this at 95.0% confidence with false-positive risk.

@vbansal67/npm-is-so-so-tuff@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code