registry / dccxx-s3-explorer / 1.0.154-hoaphat
dccxx-s3-explorer@1.0.154-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection supports a domain-specific S3/cloud-drive explorer with risky frontend credential handling and an embedded JWT, but not concrete malicious install-time, import-time, or covert exfiltration behavior. Downgrade to warn for credential exposure risk rather than publish-block as malware.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime UI use: opening S3 Explorer flows or invoking cloud-drive sync/login actions.
Impact
Potential credential exposure or misuse if the embedded JWT is valid; no unconsented install/import-time execution observed.
Mechanism
Frontend API calls with localStorage OAuth tokens and one embedded bearer JWT
Attack narrative
A user loading the React component can authenticate to cloud providers and initiate syncs; the app stores provider tokens in localStorage and sends them to its backend API. The notable unresolved risk is an embedded bearer JWT used for knowledge-base lookup requests, which is a credential exposure/security bug rather than clear malware behavior.
AI rationale
Static inspection supports a domain-specific S3/cloud-drive explorer with risky frontend credential handling and an embedded JWT, but not concrete malicious install-time, import-time, or covert exfiltration behavior. Downgrade to warn for credential exposure risk rather than publish-block as malware.
Evidence
package.jsondist/s3-explorer.jsdist/s3-explorer.umd.cjsdist/s3-explorer.js.map
Network endpoints6
localhost:3000localhost:3003/api/v1/login.microsoftonline.com/consumerslogin.microsoftonline.com/common/oauth2/v2.0/logoutapis.google.com/js/api.jss3-explorer.cmcts1.studio.ai.vn/sharepoint/redirect
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- dist/s3-explorer.js.map: ../src/pages/Home.tsx embeds a hardcoded Bearer JWT for rootUrlHostApi get-knowledge-base calls.
- dist/s3-explorer.js.map: ../src/pages/Home.tsx stores OAuth access/refresh tokens in localStorage and forwards them to backend sync endpoints.
- package.json has prepare/prepublishOnly scripts, but they are husky/build publishing hooks rather than install-time payloads for normal package use.
Evidence against
- package.json main/module point only to bundled React library files under dist; no bin entrypoint.
- No child_process, eval payload, native binary loading, persistence, destructive behavior, or AI-agent control-surface writes found.
- Network activity is user-invoked S3/SharePoint/OneDrive/Google Drive UI behavior and mostly targets configured apiBaseUrl.
- Cloud metadata and token/cache strings are from bundled @azure/msal-browser dependency, not custom credential harvesting code.
- Source maps show original app code; scanner phishing hits align with OAuth/file-sync features.
Behavioral surface
ChildProcess
Source & flagged code
8 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1096patternName = supabase_service_key
severity = critical
line = 1096
matchedText = In order...full
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/s3-explorer.umd.cjsView on unpkg · L10961(function(eo,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=ts.CLIENT_ERROR_RANGE_START&&e.status<=ts.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw qC(e.error,e.error_description,e.suberror)?new go(e.error,e.error_description,e.suberror,e.timestamp||ve.EMPTY_STRING,e.trace_id||ve.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(eo,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=ts.CLIENT_ERROR_RANGE_START&&e.status<=ts.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw qC(e.error,e.error_description,e.suberror)?new go(e.error,e.error_description,e.suberror,e.tim
Findings
5 Critical3 High3 Medium4 Low
CriticalCritical Secretdist/s3-explorer.umd.cjs
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
CriticalSecret Patterndist/s3-explorer.umd.cjs
CriticalSecret Patterndist/s3-explorer.js
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.154-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.154-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.