registry / Credential exfiltration / clintplay-sdk
clintplay-sdk
Clintplay - Session replay, error tracking, and automatic Playwright test generation
This report shows the evidence for clintplay-sdk@0.9.1. 1 of 4 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe default runtime path captures application request credentials and sends them to the package-selected telemetry endpoint without default credential redaction or recipient-specific consent. This is concrete credential disclosure, so the package should be blocked.
Static reason
No blocking static signals were detected.
Trigger
An application calls the exported `init()` with the default `recordNetwork` setting enabled, then makes fetch requests containing credentials.
Impact
Application credentials may be disclosed to the package-selected telemetry recipient.
Mechanism
The SDK patches fetch, records request headers and bodies, applies no default request-header or body deny rules, and posts event batches to its configured API endpoint.
Attack narrative
When an application initializes the SDK with its defaults, the recorder observes fetch traffic and includes request headers and bodies in telemetry events. Request credential filtering is optional, while the package-selected API endpoint receives event batches. An application login request can therefore disclose credentials to that endpoint.
AI rationale
The default runtime path captures application request credentials and sends them to the package-selected telemetry endpoint without default credential redaction or recipient-specific consent. This is concrete credential disclosure, so the package should be blocked.
Evidence
package.jsondist/index.js
Network endpoints1
api.clintplay.example/v1/events
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json routes package consumers to the inspected `dist/index.js` entrypoint.
- The bundle defaults to the Clintplay API and enables network recording.
- Calling `init()` starts the network recorder when `recordNetwork` is enabled.
- The fetch recorder copies outgoing request headers and bodies, plus text or JSON responses, into network events.
- Only response `set-cookie` is always filtered; request-header and body filtering requires optional sanitization rules.
- The SDK batches events and sends them by POST to its configured API endpoint.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/index.jsView file
1'use strict';Object.defineProperty(exports,'__esModule',{value:true});var rrweb=require('rrweb');var ee={apiUrl:"https://api.clintplay.example/v1",maskAllInputs:true,recordNetwork:...
L2: `)),r.length;e+=m;let E=g.replace(/\$/g,"$$$$"),y=c.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),v=new RegExp(`url\\(\\s*(?:"${y}"|'${y}'|${y})\\s*\\)`);p=p.replace(v,`url("${E}")`),o=tru...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.jsView on unpkg · L11api.clintplay.example/v1",maskAllInputs:true,recordNetwork:true,recordConsole:true,trackPerformance:true,trackRageClicks:true,trackNavigation:true,compressEvents:true,persistence:"localStorage",flushIntervalMs:15e3,flushMaxBytes:256e3};var te=1e3;function ne(r){if(!r.projectId)throw new Error("[Clintplay] projectId is required");if(!r.projectId.sta
High
Ai Review Evidence
The bundle defaults to the Clintplay API and enables network recording.
dist/index.jsView on unpkg · L13,$.start(),Y=new M(e.id,f),Y.start(),G=new L(e.id,f),G.start(),l.recordNetwork&&(j=new A(e.id,i=>{let s=Z.sanitizeNetworkEvent(i.data);f({...i,data:s});},l.apiUrl,l.networkIgnoreUrls),j.start()),l.recordConsole&&(z=new x(e.id,f),z.start()),l.trackPerformance&&(T=new D(e.id,f),T.start()),l.trackRageClicks&&(X=new O(e.id,f),X.start()),l.trackNavigati
Findings
7 High2 Medium3 Low
HighBrowser Session Account Hijackdist/index.js
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
HighAi Review Evidencepackage.json
HighAi Review Evidencedist/index.js
HighAi Review Evidencedist/index.js
HighAi Review Evidencedist/index.js
HighAi Review Evidencedist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to clintplay-sdk@0.9.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing clintplay-sdk@0.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.