registry / dccxx-s3-explorer / 1.0.177-hoaphat
dccxx-s3-explorer@1.0.177-hoaphat
A production ready, batteries included starter template for Vite + React projects
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no install-time hook that mutates the consumer project; its shown hooks are Husky setup and a build. The metadata endpoint reference belongs to Azure MSAL region discovery, while the inspected app configuration uses Microsoft sign-in and a service-domain redirect, so the scanner hints do not establish an attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Application use of the bundled Azure authentication SDK can invoke region discovery.
Impact
No malicious credential collection or exfiltration was established from the inspected source.
Mechanism
MSAL queries the Azure instance metadata endpoint to discover region information; inspected app configuration uses Microsoft sign-in and an application-domain redirect.
AI rationale
The manifest has no install-time hook that mutates the consumer project; its shown hooks are Husky setup and a build. The metadata endpoint reference belongs to Azure MSAL region discovery, while the inspected app configuration uses Microsoft sign-in and a service-domain redirect, so the scanner hints do not establish an attack.
Evidence
package.jsondist/s3-explorer.jsdist/s3-explorer.umd.cjs
Network endpoints3
169.254.169.254/metadata/instance/compute/locationlogin.microsoftonline.com/consumerss3-explorer.cmcts1.studio.ai.vn/sharepoint/redirect
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the two bundles as entrypoints; its shown lifecycle hooks run Husky setup and a build.
- The bundle configures Microsoft consumer sign-in and a redirect on the application’s service domain.
- The metadata endpoint reference is used by Azure MSAL region discovery, and the same SDK code appears in the UMD bundle.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flagged · loading sourcedist/s3-explorer.umd.cjsView file
1(function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw xx(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.timestamp||ye.EMPTY_STRING,e.trace_id||ye.EMPTY_STRING,e.correlation_.
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/s3-explorer.umd.cjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/s3-explorer.umd.cjs
L1: (function(ho,a){typeof exports=="object"&&typeof module<"u"?a(exports,require("react/jsx-runtime"),require("react"),require("react-dom")):typeof define=="function"&&define.amd?defi...
L2: Error: ${i.errorCode}
...
L4: Error: ${c.name}
L5: Error Description: ${c.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne...
L6: ${c}`);return}else if(n&&e.status&&e.status>=ps.CLIENT_ERROR_RANGE_START&&e.status<=ps.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ...
L7: ${c}`);return}throw xx(e.error,e.error_description,e.suberror)?new Ao(e.error,e.error_description,e.suberror,e.tim
Findings
4 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/s3-explorer.js
CriticalBrowser Credential Phishingdist/s3-explorer.umd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/s3-explorer.umd.cjs
CriticalPrevious Version Dangerous Deltadist/s3-explorer.js
HighHigh Secretdist/s3-explorer.umd.cjs
HighCloud Metadata Accessdist/s3-explorer.umd.cjs
HighTrigger Reachable Credential Exfiltrationdist/s3-explorer.js
HighSecret Patterndist/s3-explorer.umd.cjs
HighSecret Patterndist/s3-explorer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to dccxx-s3-explorer@1.0.177-hoaphat.
See all versions of dccxx-s3-explorer for other recorded verdicts.
- Review the evidence and your use of dccxx-s3-explorer@1.0.177-hoaphat before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.