registry / @vbansal67/official-publisher / 1.0.0

@vbansal67/official-publisher@1.0.0

Web

AI Security Review

scanned 25d ago · by lpm-firewall-ai

When a user opens the HTML page and clicks Publish, it transmits their npm bearer token and selected package payload through a third-party Worker. This creates a credential and package-data exfiltration path.

Static reason

No blocking static signals were detected.

Trigger

Opening index.html and clicking Publish after supplying a token and file.

Impact

The proxy can receive npm credentials and the full selected package contents.

Mechanism

Proxying an authenticated package upload through a third-party endpoint.

Attack narrative

The page presents itself as an npm publisher, collects an npm token and package file, then routes the authenticated PUT request through a third-party Cloudflare Worker in normal browser use. The proxy receives both the Authorization header and serialized file attachments, enabling credential and package-data capture. The page also embeds a prefilled npm token.

AI rationale

This is a concrete credential and data-exfiltration path through an undisclosed third-party proxy. It is user-triggered rather than install-time, but the token-routing behavior warrants blocking publication.

Evidence

app.jsindex.html

Network endpoints2

dawn-salad-6ee1.vihaanb0715.workers.devregistry.npmjs.org

Decision evidence

public snapshot

@vbansal67/official-publisher@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code