dccxx-s3-explorer@1.0.155-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection does not show unconsented install-time execution or clear attacker exfiltration, so this is not a publish-block malware finding. The hardcoded bearer credential and runtime token handling are serious enough to warn rather than mark clean.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Runtime use of the S3Explorer React component and cloud/knowledge-base actions
Impact
Potential unauthorized API access or token exposure through the distributed client bundle
Mechanism
hardcoded API bearer token and browser-stored OAuth tokens used in sync requests
AI rationale
Static inspection does not show unconsented install-time execution or clear attacker exfiltration, so this is not a publish-block malware finding. The hardcoded bearer credential and runtime token handling are serious enough to warn rather than mark clean.
Evidence
package.jsonREADME.mddist/s3-explorer.jsdist/s3-explorer.umd.cjs
Network endpoints7
localhost:3002localhost:3003/api/v1/login.microsoftonline.com/consumerslogin.microsoftonline.com/common/oauth2/v2.0/logouts3-explorer.cmcts1.studio.ai.vn/sharepoint/redirectapis.google.com/js/api.jsaccounts.google.com/gsi/client
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- dist/s3-explorer.js contains a hardcoded Bearer JWT in an Authorization header for get-knowledge-base calls.
- dist/s3-explorer.js stores OAuth access and refresh tokens in localStorage for SharePoint, OneDrive, and Google Drive flows.
- dist/s3-explorer.js sends those tokens to backend sync endpoints when user triggers cloud-to-S3 sync.
- README.md and package metadata describe a generic Vite boilerplate, not the shipped S3/cloud-sync UI.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepare only runs husky.
- No child_process, shell execution, native binary loading, or dynamic remote code execution found in package entrypoints.
- Network activity is frontend/user-flow aligned: localhost API defaults plus Microsoft and Google OAuth endpoints.
- Cloud metadata URL appears inside bundled MSAL dependency constants, not package-authored harvesting logic.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
Source & flagged code
9 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1096patternName = supabase_service_key
severity = critical
line = 1096
matchedText = In order...full
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/s3-explorer.umd.cjsView on unpkg · L10961(function(to,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=ls.CLIENT_ERROR_RANGE_START&&e.status<=ls.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw qC(e.error,e.error_description,e.suberror)?new wo(e.error,e.error_description,e.suberror,e.timestamp||ye.EMPTY_STRING,e.trace_id||ye.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(to,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=ls.CLIENT_ERROR_RANGE_START&&e.status<=ls.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw qC(e.error,e.error_description,e.suberror)?new wo(e.error,e.error_description,e.suberror,e.tim
Findings
6 Critical3 High3 Medium4 Low
CriticalCritical Secretdist/s3-explorer.umd.cjs
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
CriticalPrevious Version Dangerous Deltadist/s3-explorer.umd.cjs
CriticalSecret Patterndist/s3-explorer.umd.cjs
CriticalSecret Patterndist/s3-explorer.js
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.155-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.155-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.