registry / dccxx-s3-explorer / 1.0.153-hoaphat
dccxx-s3-explorer@1.0.153-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection supports a warning for hardcoded credentials and broad cloud-management capability, but not a publish block for malware. Suspicious scanner hits are mostly bundled MSAL/axios/React app behavior or user-invoked product functionality.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User renders and uses exported React S3Explorer/Summary/Job components.
Impact
Potential unauthorized use of the embedded knowledge-base credential and exposure of OAuth tokens stored in browser localStorage.
Mechanism
hardcoded credential plus user-invoked cloud file explorer API calls
Attack narrative
The package is a bundled React S3/cloud document explorer. On user interaction it calls configured backend APIs for upload, delete, rename, download, crawl, scheduler, SharePoint, OneDrive, and Google Drive workflows. One backend knowledge-base request includes an embedded Bearer JWT, creating a credential exposure risk, but inspected source does not show install-time execution, covert exfiltration, persistence, destructive local actions, or AI-agent control-surface mutation.
AI rationale
Static inspection supports a warning for hardcoded credentials and broad cloud-management capability, but not a publish block for malware. Suspicious scanner hits are mostly bundled MSAL/axios/React app behavior or user-invoked product functionality.
Evidence
package.jsonREADME.mddist/s3-explorer.jsdist/s3-explorer.umd.cjsdist/s3-explorer.js.map
Network endpoints7
localhost:3002localhost:3003/api/v1/login.microsoftonline.com/consumerss3-explorer.cmcts1.studio.ai.vn/sharepoint/redirectapis.google.com/js/api.jsaccounts.google.com/Logout/auth/drive
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- dist/s3-explorer.js contains a hardcoded Bearer JWT in an Authorization header for get-knowledge-base API calls.
- dist/s3-explorer.js embeds Google API key/client ID and Azure MSAL client/redirect config.
- Runtime UI stores OAuth/access tokens in localStorage for SharePoint, OneDrive, and Google Drive integrations.
Evidence against
- package.json has no install/postinstall hook; prepare is husky and prepublishOnly only runs build when publishing.
- Entrypoints export React components/API_BASE_URL and do not run network calls on package import alone.
- Network, localStorage, metadata, and file delete/upload actions are aligned with an S3/cloud file explorer UI and user actions.
- Scanner cloud metadata hit is bundled @azure/msal-common constant, not package-specific credential harvesting.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1096patternName = supabase_service_key
severity = critical
line = 1096
matchedText = In order...full
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/s3-explorer.umd.cjsView on unpkg · L10961(function(eo,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=ts.CLIENT_ERROR_RANGE_START&&e.status<=ts.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw qC(e.error,e.error_description,e.suberror)?new go(e.error,e.error_description,e.suberror,e.timestamp||ve.EMPTY_STRING,e.trace_id||ve.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(eo,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=ts.CLIENT_ERROR_RANGE_START&&e.status<=ts.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw qC(e.error,e.error_description,e.suberror)?new go(e.error,e.error_description,e.suberror,e.tim
Findings
5 Critical3 High3 Medium4 Low
CriticalCritical Secretdist/s3-explorer.umd.cjs
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
CriticalSecret Patterndist/s3-explorer.umd.cjs
CriticalSecret Patterndist/s3-explorer.js
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.153-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.153-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.