Loading npm security reports…

credstore@1.0.4: Clean npm security report (Allow) | LPM Firewall

registry / credstore / 1.0.4

credstore@1.0.4

Secure Offline Credential Manager

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a local Electron/Next credential manager; sensitive data is encrypted in browser localStorage and no outbound exfiltration path was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs credstore CLI or Electron app; optional desktop entry only with --install-desktop.

Impact

No malicious impact confirmed by static source inspection.

Mechanism

local encrypted credential storage and Electron app launch

Rationale

Scanner signals are explained by package-aligned credential-manager functionality, development localhost loading, and explicit user-invoked desktop integration. Static inspection found no install-time mutation, credential harvesting beyond user-entered vault data, exfiltration, remote payload execution, persistence, or AI-agent control-surface writes.

Evidence

package.jsonbin/credstore.jselectron/main.jsout/_next/static/chunks/app/page-d3a4843896691c78.jsREADME.md~/.local/share/applications/credstore.desktop

Network endpoints1

localhost:3000

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
bin/credstore.js is a user-invoked CLI that spawns Electron and only writes a Linux .desktop file when --install-desktop is passed.
electron/main.js loads local out/index.html in production and blocks new windows/non-file navigation.
out/_next/static/chunks/app/page-d3a4843896691c78.js uses Web Crypto AES-GCM/PBKDF2 and localStorage key credstore_data for local vault data.
No fetch/XMLHttpRequest/WebSocket/sendBeacon or external exfiltration endpoint found in runtime code.
README.md describes offline credential manager behavior consistent with inspected code.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

Source & flagged code

2 flagged

out/_next/static/chunks/app/page-d3a4843896691c78.jsView file

Lines 1-1javascript

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[931],{1650:function(e,t,a){Promise.resolve().then(a.bind(a,2206))},2206:function(e,t,a){"use strict";a.r(t),a.d(t,{default:function(){return eC}});var s=a(7437),r=a(2265),l=a(7053),n=a(535),i=a(1994),d=a(3335);function o(){for(var e=arguments.length,t=Array(e),a=0;a<e;a++)t[a]=arguments[a];return(0,d.m6)((0,i.W)(t))}let c=(0,n.j)("inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-vi ...

Medium

Secret Pattern

Package contains a possible secret pattern.

out/_next/static/chunks/app/page-d3a4843896691c78.jsView on unpkg · L1

Long lines were clipped for display.

bin/credstore.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = credstore@1.0.3 matchedIdentity = npm:Y3JlZHN0b3Jl:1.0.3 similarity = 0.944 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/credstore.jsView on unpkg

Source & flagged code

2 flagged · loading source

out/_next/static/chunks/app/page-d3a4843896691c78.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = (self.we...}]);

Medium

Secret Pattern

Package contains a possible secret pattern.

out/_next/static/chunks/app/page-d3a4843896691c78.jsView on unpkg · L1

bin/credstore.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/credstore.jsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltabin/credstore.js

MediumSecret Patternout/_next/static/chunks/app/page-d3a4843896691c78.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings