registry / dccxx-s3-explorer / 1.0.128
dccxx-s3-explorer@1.0.128
⚠ Under reviewA production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe critical metadata match is consistent with bundled MSAL's optional Azure region discovery, and the inspected lifecycle hooks do not show an install-time attack. I cannot mark the package clean because the source for its declared @azure/msal-browser dependency remained unresolved in the supplied dependency evidence.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was confirmed; the unresolved dependency may execute during installation or runtime.
Impact
No attack impact was established; the unresolved dependency source prevents a clean determination.
Mechanism
The inspected bundle's cloud metadata match belongs to MSAL region discovery, which uses the metadata endpoint when no region is configured.
AI rationale
The critical metadata match is consistent with bundled MSAL's optional Azure region discovery, and the inspected lifecycle hooks do not show an install-time attack. I cannot mark the package clean because the source for its declared @azure/msal-browser dependency remained unresolved in the supplied dependency evidence.
Evidence
package.jsondist/s3-explorer.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @azure/msal-browser; its selected dependency source remained unresolved in the supplied dependency evidence.
- The flagged metadata request is part of bundled MSAL region discovery and is used when no region value is configured.
- The package's prepare hook runs Husky, while prepublishOnly runs the build.
Evidence against
- The bundle configures Microsoft consumer sign-in with a package-associated redirect URI; inspection did not establish credential forwarding to an unrelated recipient.
- The inspected source did not establish a credential theft or install-time attack.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(Wt,d){typeof exports=="object"&&typeof module<"u"?d(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=as.CLIENT_ERROR_RANGE_START&&e.status<=as.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw TC(e.error,e.error_description,e.suberror)?new yo(e.error,e.error_description,e.suberror,e.timestamp||ve.EMPTY_STRING,e.trace_id||ve.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(Wt,d){typeof exports=="object"&&typeof module<"u"?d(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=as.CLIENT_ERROR_RANGE_START&&e.status<=as.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw TC(e.error,e.error_description,e.suberror)?new yo(e.error,e.error_description,e.suberror,e.tim
Findings
2 Critical4 High3 Medium5 Low
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.128.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.128 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.