registry / Credential exfiltration / dccxx-s3-explorer
dccxx-s3-explorer
A production ready, batteries included starter template for Vite + React projects
This report shows the evidence for dccxx-s3-explorer@1.0.176-hoaphat. 1 of 25 known versions is blocked or flagged. The newest version, 1.0.128, is allowed. See all versions.
AI Security Review
scanned 7d ago · by lpm-firewall-aiBoth package entrypoints contain a default third-party API host and code that forwards the saved application token to it. Because opening the sharing dialog triggers this transfer without recipient-specific consent, this is credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A consumer opens the file-sharing permissions dialog for a document.
Impact
The default recipient receives the application's session token, which may allow it to act as the user.
Mechanism
The component reads dataLogin.accessToken from localStorage and attaches it as a Bearer token to user and group lookup requests at the default rootUrlHostApi.
Attack narrative
When the file-sharing dialog opens, the component reads the application's saved access token and sends it in authorization headers to user and group lookup endpoints on its default hoaphat.cagent.cmcts.ai host. The package selects this recipient by default, creating a conditional disclosure of the application's session credential.
AI rationale
Both package entrypoints contain a default third-party API host and code that forwards the saved application token to it. Because opening the sharing dialog triggers this transfer without recipient-specific consent, this is credential exfiltration.
Evidence
dist/s3-explorer.jsdist/s3-explorer.umd.cjs
Network endpoints2
hoaphat.cagent.cmcts.ai/api/v1/admin/users/get-allhoaphat.cagent.cmcts.ai/api/v1/admin/group-users
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json exposes both inspected bundles as package entrypoints.
- The module bundle reads an existing application access token from localStorage.
- The file-sharing component uses https://hoaphat.cagent.cmcts.ai/api/v1/ as its default API host.
- It sends the stored token as a Bearer credential to that host's admin user and group lookup endpoints.
- The lookup runs when the file-sharing dialog opens; the CommonJS bundle contains the same default host and token transfer.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(fo,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=cs.CLIENT_ERROR_RANGE_START&&e.status<=cs.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw xx(e.error,e.error_description,e.suberror)?new Oo(e.error,e.error_description,e.suberror,e.timestamp||ye.EMPTY_STRING,e.trace_id||ye.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(fo,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=cs.CLIENT_ERROR_RANGE_START&&e.status<=cs.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw xx(e.error,e.error_description,e.suberror)?new Oo(e.error,e.error_description,e.suberror,e.tim
Findings
4 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/s3-explorer.js
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
CriticalPrevious Version Dangerous Deltadist/s3-explorer.js
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.176-hoaphat.
The versions list below shows the verdict for each recorded version.
- Avoid installing dccxx-s3-explorer@1.0.176-hoaphat. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.