registry / cloud-web-corejs / 1.0.248

cloud-web-corejs@1.0.248

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malware behavior was found, but the package has unresolved risk from obfuscated runtime code and embedded cloud storage credentials. Activation is through the Vue app importing and registering the package components.

Static reason

One or more suspicious static signals were detected.

Trigger

Application imports src/index.js or invokes ExcelImport/OBS upload components

Impact

Potential credential exposure and hard-to-audit runtime network behavior; no confirmed exfiltration or install-time compromise

Mechanism

obfuscated Vue component logic plus hardcoded OBS credentials

Attack narrative

On normal npm install there is no lifecycle execution. When the consuming Vue app imports src/index.js, it registers ExcelImport, whose obfuscated files add import/download behavior and post spreadsheet rows to configured backend URLs. OBS upload code ships default cloud credentials and endpoint values. These are serious review risks, but inspection did not show package install compromise, foreign persistence, credential harvesting from the host, or exfiltration to an attacker-controlled endpoint.

Rationale

Static source inspection supports a warning for obfuscated runtime application code and exposed cloud credentials, but not a publish block because there is no install-time execution or concrete malicious exfiltration/persistence path. The suspicious primitives are mainly user/app-invoked Vue import/upload/form scripting features.

Evidence

package.jsonsrc/index.jssrc/components/excelImport/index.jssrc/components/excelImport/mixins.jssrc/components/obsUpload/mixins.jssrc/utils/request.jssrc/utils/auth.js

Network endpoints2

obs.cn-south-1.myhuaweicloud.comprocess.env.VUE_APP_BASE_API

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

src/components/excelImport/index.js and mixins.js are heavily obfuscated and imported by src/index.js during app bootstrap
src/components/excelImport/mixins.js performs runtime $http POSTs to configured import endpoints with parsed spreadsheet data
src/components/obsUpload/mixins.js contains hardcoded Huawei OBS access_key_id/secret_access_key/server/Bucket defaults
src/components/xform uses many user-configured new Function/eval hooks for form scripts and rendering

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks, bin, main, or module entry
No child_process, shell execution, native binary loading, persistence, or AI-agent control-surface writes found
Network use is app-aligned: axios/$http to process.env.VUE_APP_BASE_API or configured upload/import endpoints
Obfuscated excel import code appears to implement UI import/download workflow, not credential harvesting or external exfiltration

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 258 file(s), 3.73 MB of source, external domains: cainiao-oss-sh-read.oss-cn-shanghai.aliyuncs.com, cdn.bootcss.com, cdn.staticfile.org, cloudprint.cainiao.com, file-link.pinduoduo.com, github.com, hiprint.io, ks3-cn-beijing.ksyun.com, ks3-cn-beijing.ksyuncs.com, lf26-cdn-tos.bytecdntp.com, map.baidu.com, meta.pinduoduo.com, obs.cn-south-1.myhuaweicloud.com, portrait.gitee.com, prod-oms-app-cprt.jdwl.com, vos.vipstatic.com, www.vform666.com, www.w3.org, xhswaybill-printer-1251524319.cos.ap-shanghai.myqcloud.com

Source & flagged code

5 flagged

src/components/xform/utils/sfc-generator.jsView file

Lines 105-145javascript

105 },

106

107 'sub-form': (ctn, formConfig) => {

108 //TODO:

109 },

110

111}

112

113export function buildContainerWidget(widget, formConfig) {

114 return containerTemplates[widget.type] ? containerTemplates[widget.type](widget, formConfig) : null

115}

116

117function getElAttrs(widget, formConfig) { //获取El组件属性

118 let wop = widget.options

119 return {

120 vModel: `v-model="${formConfig.modelName}.${wop.name}"`,

121 readonly: wop.readonly ? `readonly="true"` : '',

122 disabled: wop.disabled ? `:disabled="true"` : '',

123 size: !!wop.size ? `size="${wop.size}"` : '',

124 type: !!wop.type ? `type="${wop.type === 'number' ? 'text' : wop.type}"` : '',

125 showPassword: !!wop.showPassword ? `:show-password="${wop.showPassword}"` : '',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/components/xform/utils/sfc-generator.jsView on unpkg · L125

126 placeholder: !!wop.placeholder ? `placeholder="${wop.placeholder}"` : '',

127 rows: (isNotNull(wop.rows) && !isNaN(wop.rows)) ? `rows="${wop.rows}"` : '',

128 clearable: !!wop.clearable ? 'clearable' : '',

129 minlength: (isNotNull(wop.minLength) && !isNaN(wop.minLength)) ? `:minlength="${wop.minLength}"` : '',

130 maxlength: (isNotNull(wop.maxLength) && !isNaN(wop.maxLength)) ? `:maxlength="${wop.maxLength}"` : '',

131 showWordLimit: !!wop.showWordLimit ? `:show-word-limit="true"`: '',

132 prefixIcon: !!wop.prefixIcon ? `prefix-icon="${wop.prefixIcon}"` : '',

133 suffixIcon: !!wop.suffixIcon ? `suffix-icon="${wop.suffixIcon}"` : '',

134 controlsPosition: wop.controlsPosition === 'right' ? `controls-position="right"` : '',

135 min: (isNotNull(wop.min) && !isNaN(wop.min)) ? `:min="${wop.min}"` : '',

136 max: (isNotNull(wop.max) && !isNaN(wop.max)) ? `:max="${wop.max}"` : '',

137 precision: (isNotNull(wop.precision) && !isNaN(wop.precision)) ? `:precision="${wop.precision}"` : '',

138 step: (isNotNull(wop.step) && !isNaN(wop.step)) ? `:step="${wop.step}"` : '',

139 filterable: !!wop.filterable ? `filterable` : '',

140 allowCreate: !!wop.allowCreate ? `allow-create` : '',

141 defaultFirstOption: (!!wop.filterable && !!wop.allowCreate) ? `default-first-option` : '',

142 multiple: !!wop.multiple ? `multiple` : '',

143 multipleLimit: (!isNaN(wop.multipleLimit) && (wop.multipleLimit > 0)) ? `:multiple-limit="${wop.multipleLimit}"` : '',

144 automaticDropdown: !!wop.automaticDropdown ? `automatic-dropdown` : '',

145 remote: !!wop.remote ? `remote` : '',

src/components/hiprint/hiprint.bundle.jsView file

Lines 1276-1316javascript

1276 flag = document.execCommand("copy");

1277 copyArea.css('visibility', 'hidden');

1278 // 获取元素焦点，不然无法粘贴（keydown问题）

1279 n.designTarget.focus();

1280 console.log('copyJson success');

1281 } catch

src/mixins/mobile/wf/index.jsView file

Lines 1-25javascript

1import Vue from 'vue';

2import settingConfig from '@/settings.js'

4let configUtil = {

5 getWfObj(path) {

6 return require(`../../../components/mobile/wf${path}`).default;

src/components/excelImport/mixins.jsView file

Lines 1-19javascript

1/**version-1.0*/

2import {read, utils} from 'xlsx'

4let tmixins = {};

5var XLSX = window.XLSX || {read, utils};

6import {

7 getToken

8} from

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView file

•path = [redacted]-halflings-regular.woff kind = high_entropy_blob sizeBytes = 23424 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView on unpkg

Source & flagged code

5 flagged · loading source

src/components/xform/utils/sfc-generator.jsView file

125patternName = generic_password severity = medium line = 125 matchedText = showPass... '',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/components/xform/utils/sfc-generator.jsView on unpkg · L125

src/components/hiprint/hiprint.bundle.jsView file

1296var s = "formatter=" + this.options.formatter; L1297: eval(s); L1298: } catch (t) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/components/hiprint/hiprint.bundle.jsView on unpkg · L1296

src/mixins/mobile/wf/index.jsView file

5getWfObj(path) { L6: return require(`../../../components/mobile/wf${path}`).default; L7: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/mixins/mobile/wf/index.jsView on unpkg · L5

src/components/excelImport/mixins.jsView file

16}; L17: function _0x47a6(_0x1e39ba,_0xe90b39){const _0x13ce7f=_0xe90b();_0x47a6=function(_0x4106a1,_0x47a825){_0x4106a1=_0x4106a1-0x0;let _0x44fded=_0x13ce7f[_0x4106a1];if(_0x47a6["\u006f\... L18: export const mixins = tmixins;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

src/components/excelImport/mixins.jsView on unpkg · L16

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView file

•path = [redacted]-halflings-regular.woff kind = high_entropy_blob sizeBytes = 23424 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/components/hiprint/fonts/glyphicons-halflings-regular.woffView on unpkg

Findings

3 High5 Medium5 Low

HighObfuscated Payload Loadersrc/components/excelImport/mixins.js

HighObfuscated

HighShips High Entropy Blobsrc/components/hiprint/fonts/glyphicons-halflings-regular.woff

MediumSecret Patternsrc/components/xform/utils/sfc-generator.js

MediumDynamic Requiresrc/mixins/mobile/wf/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/components/hiprint/hiprint.bundle.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License