Loading npm security reports…

credstore@1.0.3: Clean npm security report (Allow) | LPM Firewall

registry / credstore / 1.0.3

credstore@1.0.3

Secure Offline Credential Manager

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an offline credential manager with user-invoked CLI/Electron runtime and local encrypted browser storage.

Static reason

One or more suspicious static signals were detected.

Trigger

user runs credstore or Electron app

Impact

credentials remain local to browser localStorage unless user exports or copies them

Mechanism

local AES-GCM credential storage and Electron wrapper

Rationale

Source inspection shows suspicious primitives are package-aligned: Electron launch, localStorage credential storage, Web Crypto encryption, and local app file loading. There is no install-time execution, credential harvesting beyond user-entered app data, exfiltration endpoint, remote payload loading, persistence, or AI-agent control-surface mutation.

Evidence

package.jsonbin/credstore.jselectron/main.jsout/_next/static/chunks/app/page-83bc23a92d0680f1.jsREADME.mdout/index.html

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts
bin/credstore.js only handles help/version and user-invoked Electron launch
electron/main.js loads local out/index.html in production and denies new external windows
Electron webPreferences disable nodeIntegration and enable contextIsolation/webSecurity
out/_next/static/chunks/app/page-83bc23a92d0680f1.js stores encrypted credential data in localStorage using Web Crypto
No runtime fetch/XMLHttpRequest/sendBeacon or exfiltration endpoint found in reviewed sources

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 798 KB of source, external domains: github.com, nextjs.org, radix-ui.com, react.dev, reactjs.org, www.w3.org

Source & flagged code

1 flagged

out/_next/static/chunks/app/page-83bc23a92d0680f1.jsView file

Lines 1-1javascript

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[931],{1650:function(e,t,a){Promise.resolve().then(a.bind(a,2206))},2206:function(e,t,a){"use strict";a.r(t),a.d(t,{default:function(){return eC}});var s=a(7437),r=a(2265),l=a(7053),n=a(535),i=a(1994),d=a(3335);function o(){for(var e=arguments.length,t=Array(e),a=0;a<e;a++)t[a]=arguments[a];return(0,d.m6)((0,i.W)(t))}let c=(0,n.j)("inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-vi ...

Medium

Secret Pattern

Package contains a possible secret pattern.

out/_next/static/chunks/app/page-83bc23a92d0680f1.jsView on unpkg · L1

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

out/_next/static/chunks/app/page-83bc23a92d0680f1.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = (self.we...}]);

Medium

Secret Pattern

Package contains a possible secret pattern.

out/_next/static/chunks/app/page-83bc23a92d0680f1.jsView on unpkg · L1

Findings

5 Medium5 Low

MediumSecret Patternout/_next/static/chunks/app/page-83bc23a92d0680f1.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings