dccxx-s3-explorer@1.0.168-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 23d ago · by lpm-firewall-aiSource establishes user-activated forwarding of existing service credentials to an unrestricted caller-configured backend. This warrants a credential-exposure warning, while the inspected code does not establish malicious behavior eligible for blocking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user selects Google Drive files or clicks a cloud synchronization button in the rendered explorer.
Impact
An untrusted configured backend could receive service access tokens; Microsoft synchronization also forwards refresh tokens.
Mechanism
The component reads OAuth tokens from local storage and includes them in synchronization requests whose destination derives from apiBaseUrl.
AI rationale
Source establishes user-activated forwarding of existing service credentials to an unrestricted caller-configured backend. This warrants a credential-exposure warning, while the inspected code does not establish malicious behavior eligible for blocking.
Evidence
dist/s3-explorer.jsdist/s3-explorer.umd.cjs
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explorer accepts a caller-configured apiBaseUrl and forwards component properties to its active implementation.
- Google Drive synchronization reads an existing OAuth access token from browser local storage.
- Synchronization sends that token as a bearer credential to the configured backend without restricting it to Google's service.
- The UMD entrypoint contains the same credential-forwarding operation.
- Google file selection and a OneDrive synchronization button activate these operations.
- The manifest has a Husky prepare hook but no preinstall, install, or postinstall hook.
Evidence against
- Synchronization follows user interaction and supports the package's cloud-file explorer functionality.
- No concrete covert recipient, malicious installation behavior, or malware execution was established.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(ho,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=us.CLIENT_ERROR_RANGE_START&&e.status<=us.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw yx(e.error,e.error_description,e.suberror)?new No(e.error,e.error_description,e.suberror,e.timestamp||ve.EMPTY_STRING,e.trace_id||ve.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(ho,c){typeof exports=="object"&&typeof module<"u"?c(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${a.name}
L5: Error Description: ${a.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${a}`);return}else if(n&&e.status&&e.status>=us.CLIENT_ERROR_RANGE_START&&e.status<=us.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${a}`);return}throw yx(e.error,e.error_description,e.suberror)?new No(e.error,e.error_description,e.suberror,e.tim
Findings
3 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/s3-explorer.js
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.168-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.168-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.