registry / Credential exfiltration / @websolutespa/bom-mixer-auth
@websolutespa/bom-mixer-auth
Mixer Auth module of the BOM Repository
This report shows the evidence for @websolutespa/bom-mixer-auth@3.1.3. 1 of 3 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe published server handler silently copies password-reset emails to a hard-coded personal Gmail address. Forwarding reset messages to a recipient chosen by the package author exposes account recovery links and creates a concrete account takeover risk.
Static reason
One or more suspicious static signals were detected.
Trigger
An application invokes authForgotHandler and a user submits a password-reset request.
Impact
The BCC recipient can receive password-reset messages and their reset links, creating an account takeover path.
Mechanism
The handler adds lzampetti@gmail.com as the default BCC recipient and forwards the email body and recipient to /end_users/forgot.
Attack narrative
When an application uses the exported password-reset handler, reset requests generate an email that is BCCed to the hard-coded personal address lzampetti@gmail.com. The handler forwards that recipient and the email body, including the reset link template, to the reset endpoint. This covertly exposes reset messages and can enable account takeover.
AI rationale
The published server handler silently copies password-reset emails to a hard-coded personal Gmail address. Forwarding reset messages to a recipient chosen by the package author exposes account recovery links and creates a concrete account takeover risk.
Evidence
src/models/auth/auth.handler.tsdist/exports/server.js
Network endpoints2
/end_users/forgotlzampetti@gmail.com (BCC recipient)
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The password-reset handler defaults its BCC recipient to lzampetti@gmail.com; the published server bundle contains the same default.
- The reset email includes a link to the configured password-reset page with an actionId placeholder.
- The handler forwards the BCC and email body in emailData to the /end_users/forgot endpoint.
Evidence against
- No install lifecycle scripts are declared; this behavior runs when an application invokes the password-reset handler.
Behavioral surface
Network
Source & flagged code
10 flaggeddist/index.jsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg221patternName = generic_password
severity = medium
line = 221
Medium
331patternName = generic_password
severity = medium
line = 331
Medium
dist/exports/server.jsView file
Findings
4 High7 Medium1 Low
HighSemantic Analysis Limiteddist/index.js
HighAi Review Evidencesrc/models/auth/auth.handler.ts
HighAi Review Evidencedist/exports/server.js
HighAi Review Evidencesrc/models/auth/auth.handler.ts
MediumSecret Patterndist/index.js
MediumNetwork
MediumSecret Patterndist/index.js
MediumSecret Patterndist/exports/server.js
MediumSecret Patternsrc/auth/auth-register.tsx
MediumSecret Patternsrc/auth/auth-login.tsx
MediumSecret Patternsrc/models/auth/auth.handler.ts
LowScripts Present
Affected versions and remediation
This report applies to @websolutespa/bom-mixer-auth@3.1.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing @websolutespa/bom-mixer-auth@3.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.