registry / dccxx-s3-explorer / 1.0.165-hoaphat

dccxx-s3-explorer@1.0.165-hoaphat

A production ready, batteries included starter template for Vite + React projects

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The scanner findings arise from bundled browser OAuth/MSAL code and normal S3-explorer functionality. Source inspection found no concrete malicious behavior or unconsented install-time mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user renders the component and selects files for upload.

Impact

Intended transfer of selected files to the configured service.

Mechanism

User-initiated multipart API upload and OAuth integration.

AI rationale

The scanner findings arise from bundled browser OAuth/MSAL code and normal S3-explorer functionality. Source inspection found no concrete malicious behavior or unconsented install-time mutation.

Evidence

package.jsondist/s3-explorer.js

Network endpoints3

localhost:3000hoaphat.cagent.cmcts.ai/api/v1/s3-explorer.cmcts1.studio.ai.vn/sharepoint/redirect

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

Prepare runs Husky VCS-hook setup.
Runtime API client defaults to localhost.
User-selected files are posted to the configured API.
Bundled Microsoft OAuth uses a fixed redirect URI.

Evidence against

No preinstall, install, or postinstall hook.
No package-owned shell, child-process, eval, or dynamic payload execution found.
Cloud-metadata and credential terms are in bundled MSAL authentication code.
Uploads are initiated from the rendered file-upload workflow.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.41 MB of source, external domains: 169.254.169.254, accounts.google.com, aka.ms, apis.google.com, developer.chrome.com, developer.mozilla.org, docs.microsoft.com, example.com, fb.me, github.com, hoaphat.cagent.cmcts.ai, lodash.com, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.us, login.partner.microsoftonline.cn, login.sovcloud-identity.de, login.sovcloud-identity.fr, login.sovcloud-identity.sg, npms.io, openjsf.org, s3-explorer.cmcts1.studio.ai.vn, tailwindcss.com, tools.ietf.org, underscorejs.org, www.googleapis.com, www.w3.org

Source & flagged code

8 flagged

dist/s3-explorer.umd.cjsView file

1(function(po,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi... L2: Error: ${i.errorCode} ... L4: Error: ${a.name} L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne... L6: ${a}`);return}else if(n&&e.status&&e.status>=ls.CLIENT_ERROR_RANGE_START&&e.status<=ls.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ... L7: ${a}`);return}throw mx(e.error,e.error_description,e.suberror)?new Io(e.error,e.error_description,e.suberror,e.timestamp||ve.EMPTY_STRING,e.trace_id||ve.EMPTY_STRING,e.correlation_.

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/s3-explorer.umd.cjsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs L1: (function(po,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi... L2: Error: ${i.errorCode} ... L4: Error: ${a.name} L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne... L6: ${a}`);return}else if(n&&e.status&&e.status>=ls.CLIENT_ERROR_RANGE_START&&e.status<=ls.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ... L7: ${a}`);return}throw mx(e.error,e.error_description,e.suberror)?new Io(e.error,e.error_description,e.suberror,e.tim

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/s3-explorer.umd.cjsView on unpkg · L1

1092patternName = google_api_key severity = high line = 1092 matchedText = In order...full

High

High Secret

Package contains a high-severity secret pattern.

dist/s3-explorer.umd.cjsView on unpkg · L1092

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/s3-explorer.umd.cjsView on unpkg · L1

1092patternName = google_api_key severity = high line = 1092 matchedText = In order...full

High

Secret Pattern

Google API key in dist/s3-explorer.umd.cjs

dist/s3-explorer.umd.cjsView on unpkg · L1092

dist/s3-explorer.jsView file

9// default authority L10: DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/", L11: DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com", ... L43: FORWARD_SLASH: "/", L44: IMDS_ENDPOINT: "http://169.254.169.[redacted]", L45: IMDS_VERSION: "2020-06-01", ... L272: }, L273: base64Decode: () => { L274: throw Pe(_t); ... L964: try { L965: const e = ZT(t), n = Object.fromEntries(new URLSearchParams(e)); L966: if (n.code || n.ear_jwe || n.error || n.error_description || n.state)

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/s3-explorer.jsView on unpkg · L9

9Trigger-reachable credential exfiltration chain: manifest.module -> dist/s3-explorer.js L9: // default authority L10: DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/", L11: DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com", ... L43: FORWARD_SLASH: "/", L44: IMDS_ENDPOINT: "http://169.254.169.[redacted]", L45: IMDS_VERSION: "2020-06-01", ... L272: }, L273: base64Decode: () => { L274: throw Pe(_t); ... L964: try { L965: const e = ZT(t), n = Object.fromEntries(new URLSearchParams(e)); L966: if (n.code || n.ear_jwe || n.error || n.error_description || n.state)

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/s3-explorer.jsView on unpkg · L9

34934patternName = google_api_key severity = high line = 34934 matchedText = }, WG = ...1 };

High

Source & flagged code

8 flagged · loading source

dist/s3-explorer.umd.cjsView file

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/s3-explorer.umd.cjsView on unpkg · L1

Findings

3 Critical5 High3 Medium4 Low

CriticalCredential Exfiltrationdist/s3-explorer.js

CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs

HighHigh Secretdist/s3-explorer.umd.cjs

HighCloud Metadata Accessdist/s3-explorer.umd.cjs

HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js

HighSecret Patterndist/s3-explorer.umd.cjs

HighSecret Patterndist/s3-explorer.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to dccxx-s3-explorer@1.0.165-hoaphat.

See all versions of dccxx-s3-explorer for other recorded verdicts.

Review the evidence and your use of dccxx-s3-explorer@1.0.165-hoaphat before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-18 03:00:11.045Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.