dccxx-s3-explorer@1.0.126
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe shipped bundle sends an embedded bearer credential to a configurable endpoint during an ordinary UI action. The destination and token status are unresolved, so this supports a warning for credential exposure risk, not a confirmed malicious transfer.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A knowledge base selection when the component has an API URL.
Impact
If the configured endpoint is controlled by an unintended recipient and the token is valid, that recipient receives the credential.
Mechanism
The lookup request attaches the bundled bearer credential as its Authorization header; the API URL defaults to localhost:3003 and can be supplied by the component caller.
AI rationale
The shipped bundle sends an embedded bearer credential to a configurable endpoint during an ordinary UI action. The destination and token status are unresolved, so this supports a warning for credential exposure risk, not a confirmed malicious transfer.
Evidence
dist/s3-explorer.jsdist/s3-explorer.umd.cjs
Network endpoints1
localhost:3003/api/v1/
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes both distribution bundles as its main and module entrypoints.
- The UI component accepts a configurable API URL, defaulting to localhost:3003.
- When a knowledge base is selected, the bundle sends a hardcoded bearer credential to that API.
- The UMD entrypoint contains the same credential-bearing request.
Evidence against
- The request runs only when a knowledge base selection and API URL are present; the inspected source does not establish the recipient’s ownership or whether the embedded token is valid.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(qr,d){typeof exports=="object"&&typeof module<"u"?d(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=Ki.CLIENT_ERROR_RANGE_START&&e.status<=Ki.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw Zb(e.error,e.error_description,e.suberror)?new so(e.error,e.error_description,e.suberror,e.timestamp||ye.EMPTY_STRING,e.trace_id||ye.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(qr,d){typeof exports=="object"&&typeof module<"u"?d(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=Ki.CLIENT_ERROR_RANGE_START&&e.status<=Ki.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw Zb(e.error,e.error_description,e.suberror)?new so(e.error,e.error_description,e.suberror,e.tim
Findings
2 Critical4 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.126.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.126 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.